CVE-2026-58644 PoC — Microsoft SharePoint Remote Code Execution Vulnerability

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58644.yaml

Associated Vulnerability

Title: Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2026-58644)
Description:Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Description

Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with
NotSupportedCookieTransform, making ReadToken() throw before deserialization.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →