CERT-In warns of exploited SharePoint and AD FS flaws

CERT-In warned on 17 July that three Microsoft vulnerabilities were being exploited in the wild, including two in SharePoint and one in Active Directory Federation Services. Its July advisory directed users to apply patches immediately.

CVE-2026-58644 concerned SharePoint’s handling of untrusted serialised data and could permit remote code execution without authentication. CVE-2026-56164 was a separate SharePoint authentication weakness that could allow privilege escalation over a network. CVE-2026-56155 concerned access controls in AD FS and required an authenticated attacker.

These differences affect how administrators assess exposure: the two SharePoint issues did not require an existing authenticated account, while the AD FS issue did. CERT-In linked to Microsoft’s July security updates for the full product scope, workarounds and fixes.

The wider bulletin covered several Microsoft product families, but its active-exploitation warning named these three identifiers. It did not attribute the attacks to a particular group or claim that all products in the bulletin had been compromised.