If you still run SharePoint Server on-premises, this was not your week.
Microsoft's July 14 Patch Tuesday included fixes for SharePoint flaws, and one of them, CVE-2026-58644, turned out to be exploited in the wild before the patch existed. It's a critical deserialization bug with a CVSS score of 9.8, and CISA added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until July 19 to patch [2]. That's five days. Federal agencies are not famous for five-day anything, which tells you how seriously CISA took it.
It wasn't just one bug
CISA's alert lists active exploitation of several SharePoint vulnerabilities affecting all supported on-premises versions: Subscription Edition, 2019 and 2016. Attackers are getting remote code execution, then stealing IIS machine keys and using deserialization tricks to stay in and drop malware [1]. Stolen machine keys are the nasty part: patching alone doesn't evict someone who already copied them.
CISA has kept updating that alert since, adding more CVEs to the list in July and August [1]. When a government alert gets a changelog, pay attention.
The boring fix (which is the right fix)
Based on CISA's guidance [1], in plain language:
- Patch now. All of it, all supported versions.
- Get it off the internet. CISA specifically updated its alert to clarify guidance on not exposing SharePoint Servers directly to the internet [1].
- Assume compromise if it was exposed. Look for signs of tampering and rotate those machine keys.
- Ask the real question: does this workload still need to live on a server in your closet?
My take
On-prem SharePoint is the cast-iron skillet of enterprise software: durable, beloved by a few, and a real hazard if you leave it on the burner unattended. Some organizations have good reasons to keep it. Most just never got around to moving.
If yours is one of the "never got around to it" crowd, let this week be the nudge. And if it truly must stay, treat it like the internet-facing crown jewel it is: patched on day one, monitored, and as unreachable as possible.
A word on ownership
The hardest part of on-prem collaboration servers is rarely the technology. It's that nobody is clearly responsible for them anymore. The person who installed it moved on, the business still depends on it, and patching it requires a maintenance window nobody wants to schedule. Put a name next to every internet-facing server. A name, not a team. That alone fixes more than you'd expect.