Exploiting CVE-2026-58644: Microsoft SharePoint Deserialization Vulnerability in Phishing Attacks

Welcome to the intricacies of how threat actors have integrated the exploitation of CVE-2026-58644, a critical deserialization vulnerability in Microsoft SharePoint, into sophisticated phishing campaigns. The vulnerability, disclosed in early September 2026, allows remote attackers to execute arbitrary code through crafted content injection in response to deserialization mishandlings. The implications are profound, as attackers leverage this flaw to initiate phishing attacks that culminate in gaining unauthorized access to target networks.

Campaign or TTP Overview

In recent months, cyber threat groups have capitalized on the CVE-2026-58644 vulnerability to launch targeted phishing campaigns against a range of sectors, notably those dependent on collaborative platforms and repositories. Primarily observed between September and November 2026, these campaigns have targeted industries such as finance, healthcare, and critical infrastructure where SharePoint is extensively integrated into daily operations. Although no threat actor group has been directly attributed to the campaign publically, tactics and tools suggest alignment with advanced persistent threat (APT) methodologies.

One notable campaign involved a deluge of phishing emails purporting to be crucial Project Update Alerts. Recipients—often carefully chosen higher-level employees—were tricked into opening malicious attachments, exploiting the identified SharePoint vulnerability to deploy malicious scripts directly onto their intranet environments without any immediate signs of compromise.

How It Was Built

To build the attack vector around CVE-2026-58644, attackers initially set up convincing infrastructure, including Domains and subdomains closely mimicking legitimate SharePoint URLs. These were crafted to blend seamlessly into expected email communications. Phishing emails carried subject lines like “Critical: Update Required for Project Collaboration Document” and were sent from spoofed sender identities mimicking those from the IT department of the targeted organization.

The emails enticed recipients with a hyperlink that appeared to direct users to a legitimate SharePoint portal but was instead a path to a malicious landing page:


https://secure-sharepoint-portal[.]secure-company-resources[.]com/login

This landing page, designed to mimic the organization’s branding, exploited the deserialization vulnerability, causing the server to execute arbitrary payloads embedded in the site. A sample payload observed in these attacks utilized a Base64-encoded PowerShell script for stealth deployment:


[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("UE9XRVJTSEVMTCBTVFJJUCBFTkNPREVEIERBVEEgSEVSRSBBTkQgRUNITyBBUERBTklPTg==")) | iex

Why It Worked

Several strategic choices made these campaigns alarmingly effective. First, the use of legitimate-seeming domains was pivotal—substituting characters like secure with secure but adding -company-resources differentiated the malicious sites subtly to avoid raising immediate suspicion. Second, the plausibility of the email content and sender perception played a crucial role. Employees in larger organizations frequently receive updates via SharePoint; receiving such communications, especially from a familiar source like IT, naturally inclined recipients to engage with them without skepticism.

Finally, the exploitation of a known vulnerability—yet untreated in many systems—amplified the attack’s success by targeting an already fragile component prone to security lapses due to overlooked updates.

Operator Takeaways

From a red teamer’s perspective, leveraging CVE-2026-58644 can provide an insightful methodology to evaluate organizational resilience against sophisticated phishing tactics. What ensures maximum impact is the commitment to detail in mimicking familiar and routine processes. Key takeaways include crafting domain names that utilize real-world blending techniques and presenting high-fidelity email content that seamlessly fits existing communication lines.

Moreover, continual updating of payload mechanisms to ensure they are versatile against current defenses enhances persistence in similar operations.

Do’s and Don’ts

Do: Establish believable sender identities. Invest time in understanding the organization’s internal communication styles.
Do: Leverage known vulnerabilities in widely used platforms to maintain relevance and effectiveness.
Don’t: Avoid creating overly complex scripts or payloads that could trigger detection mechanisms. Simplicity often trumps sophistication.
Don’t: Underestimate the value of inconspicuous domain and email design.

References

CISA Known Exploited Vulnerabilities Catalog

Security Affairs: CVE-2026-58644 Analysis