CVE-2026-58644: Microsoft SharePoint Server Unauthenticated RCE — Detection and Defense

---
title: SharePoint Unauthenticated RCE CVE-2026-58644 - w3wp.exe Spawning Shell
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2026-58644 by identifying the SharePoint worker process spawning a command shell or PowerShell.
references:
  - https://securityarsenal.com/blog/cve-2026-58644
author: Security Arsenal
date: 2026/04/20
tags:
  - attack.execution
  - attack.t1059.001
  - cve.2026.58644
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit:
    # Optional: Filter out known maintenance tasks if necessary, but default to alert on all w3wp spawns
    CommandLine|contains: 'authorized_script_path' 
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrative debugging (rare for w3wp)
level: critical
---
title: SharePoint Suspicious Child Process - Network Tooling
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects w3wp.exe spawning network utilities often used for reverse shells or data exfiltration post-exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/20
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
  condition: selection
falsepositives:
  - Unknown
level: high

// Hunt for SharePoint worker process spawning suspicious shells
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for suspicious processes spawned by the SharePoint Worker Process
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ 'w3wp.exe'
  AND Name IN ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash.exe')

# CVE-2026-58644 Remediation & Verification Script
# Run as Administrator on the SharePoint Server

Write-Host "Checking SharePoint Build Version for CVE-2026-58644..." -ForegroundColor Cyan

# Get the SharePoint Build Version via the registry
$sharePointRegistryPath = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions"
if (Test-Path $sharePointRegistryPath) {
    # Iterate through installed versions
    $versions = Get-ChildItem $sharePointRegistryPath
    foreach ($version in $versions) {
        $versionNumber = $version.PSChildName
        $buildPath = Join-Path $version.PSPath "BuildVersion"
        if (Test-Path $buildPath) {
            $currentBuild = (Get-ItemProperty $buildPath)."(default)"
            Write-Host "Found SharePoint Version: $versionNumber - Build: $currentBuild" -ForegroundColor Yellow
            
            # Compare against known patched versions (Placeholder - replace with actual KB targets)
            $patchedBuild = "16.0.17000.00000" 
            if ([version]$currentBuild -lt [version]$patchedBuild) {
                Write-Host "[ALERT] System is vulnerable to CVE-2026-58644. Current build $currentBuild is below patched baseline $patchedBuild." -ForegroundColor Red
            } else {
                Write-Host "[OK] System appears patched against CVE-2026-58644." -ForegroundColor Green
            }
        }
    }
} else {
    Write-Host "SharePoint Registry keys not found. Is SharePoint installed on this server?" -ForegroundColor Red
}

# Check for suspicious w3wp.exe child processes (Immediate IOC Check)
Write-Host "\nChecking for active exploitation indicators (w3wp spawning shells)..." -ForegroundColor Cyan
$suspiciousProcesses = Get-CimInstance Win32_Process | Where-Object { 
    $_.ParentProcessId -ne 0 -and 
    (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).ProcessName -eq 'w3wp' -and 
    $_.Name -in ('cmd.exe', 'powershell.exe', 'pwsh.exe')
}

if ($suspiciousProcesses) {
    Write-Host "[CRITICAL] Suspicious activity detected! w3wp.exe is spawning shells:" -ForegroundColor Red
    $suspiciousProcesses | Format-Table Name, ProcessId, ParentProcessId, CommandLine -AutoSize
} else {
    Write-Host "[OK] No immediate shell spawning activity detected from w3wp.exe." -ForegroundColor Green
}