The persistence of CVE-2026-58644, a critical unauthenticated remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint Server, highlights a shift in how attackers view enterprise infrastructure. More than two months after Microsoft released a patch on July 14, 2026, exploitation remains active. This exploitation pattern indicates a structural shift where the application layer has become as critical as the identity control plane.
The ToolShell Mechanics
The vulnerability, assigned a CVSS v3.1 score of 9.8, stems from improper deserialization of untrusted data (CWE-502). The exploit chain, dubbed ToolShell, operates in four distinct stages that bypass traditional perimeter defenses. First, an unauthenticated HTTP POST request to the SharePoint ToolPane endpoint triggers the deserialization, granting the attacker RCE under the SharePoint application pool identity. Second, the attacker drops a web shell, specifically spinstall0.aspx, into the LAYOUTS directory.
In the third and fourth stages, the web shell reads the ASP.NET machineKey material – the validationKey and decryptionKey – directly from the web.config file. With these keys in hand, an attacker can move offline to forge valid VIEWSTATE payloads and forms-authentication tickets. This allows for code execution on any server within the SharePoint farm without needing to interact with the original web shell again. Because these forged payloads are cryptographically valid, they bypass standard authentication checks, rendering the initial patch insufficient if the keys were compromised prior to remediation.
An Expanding Attack Surface
The continued exploitation of CVE-2026-58644, as noted in reporting by The Hacker News, is part of a broader trend. In 2026 alone, five distinct SharePoint vulnerabilities have been exploited in the wild. The CISA Known Exploited Vulnerabilities (KEV) catalog now contains 12 SharePoint-related entries, seven of which have been leveraged in ransomware campaigns. This volume of activity suggests that SharePoint is no longer just a collaboration tool; it is being treated as a primary target for initial access and persistence, occupying the same strategic importance as identity providers.
When an application like SharePoint holds the keys to its own authentication – literally, in the case of machineKey material – it functions as an identity provider. Compromising the application layer effectively grants the attacker control over the identity control plane. Patching the RCE is a necessary first step, but it does not invalidate the stolen keys. Organizations must rotate machineKey values across all servers in the farm to fully evict an attacker who has successfully executed the ToolShell chain.
Context and Implications
Exploitation of CVE-2026-58644 accelerated quickly. Confirmed in-the-wild exploitation occurred on July 15, 2026, leading to its addition to the CISA KEV on July 16, with a federal remediation deadline of July 19. Despite this, the ecosystem remains under pressure. The same wave of activity included CVE-2026-55040, an authentication bypass that saw continued exploitation into August 2026 following the release of proof-of-concept code.
This trajectory mirrors the risks identified in our analysis of the Azure Identity Triple-Crown, the Fabric Auth Bypass, and the Cisco ISE Nine-CVE incident. Like the Delinea Secret Server and Check Point management-plane vulnerabilities, the SharePoint situation demonstrates that the boundary between application infrastructure and identity management is effectively gone. Security professionals must treat the configuration files and cryptographic material of these platforms with the same rigor as they would a domain controller or an identity provider. If the application manages its own authentication, it is an identity target. The persistence of ToolShell proves that attackers have already reached this conclusion.