Microsoft SharePoint WS-Federation Insecure Deserialization Remote Code Execution (CVE-2026-58644)
Description
Microsoft SharePoint Server (2016, 2019, and Subscription Edition) contains an unauthenticated remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint federated authentication module decodes the SecurityContextToken cookie supplied in the wresult parameter using a deflate-only cookie transform that performs no MAC or signature validation, then passes the inflated bytes to BinaryFormatter.Deserialize() without any type restrictions.
An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe).
This endpoint was confirmed vulnerable by delivering a benign deserialization gadget that loads a small in-memory assembly and injects a marker HTTP response header, giving in-band proof of code execution.
Remediation
Apply the July 2026 Cumulative Update (KB5002882 / build 16.0.19725.20434 or later), which replaces the vulnerable DeflateCookieTransform with a NotSupportedCookieTransform so that token reading throws before deserialization.
After patching, rotate the farm machine keys using Set-SPMachineKey / Update-SPMachineKey and run iisreset to revoke any keys that may have been stolen prior to remediation. As defense in depth, enable AMSI request-body scanning for /_trust/default.aspx.