SharePoint's Last Patch Ever Fixed a Flaw Already Under Attack — and It Shipped on the Day Support Ended
Last Tuesday, July 14, two things happened to SharePoint Server 2016 and 2019 at the same time.
The first was scheduled years in advance: both versions reached the end of extended support. The second was not. On that same day, Microsoft published CVE-2026-58644 — a deserialization flaw rated CVSS 9.8 that yields remote code execution, with what Microsoft characterizes as low attack complexity — and confirmed it was already being exploited in the wild before a patch existed. Two days later, on July 16, CISA added it to the Known Exploited Vulnerabilities catalog and gave federal civilian agencies until July 19 to remediate. Three days. (Rapid7's analysis; The Hacker News on the KEV addition.)
Microsoft did ship the fix for all three affected versions — 2016, 2019, and Subscription Edition. So this is not a story about a version left to burn. It's something more useful than that.
There is no Extended Security Updates program for SharePoint
This is the detail that gets lost, because most people's mental model of a Microsoft end-of-support date was formed by Windows 10 or Windows Server 2012. In both of those cases, the deadline came with an escape hatch: pay for Extended Security Updates and keep receiving patches while you migrate.
SharePoint Server has no such program. July 14, 2026 was a hard cutoff — no security updates, no paid extension, no third-party equivalent, because SharePoint is proprietary and nobody outside Microsoft can ship a patch for it. For the open-source components in your stack there is a commercial extended-support market. For SharePoint on-premises there is not.
| Version | Extended support ended | Escape hatch |
|---|---|---|
| SharePoint Enterprise Server 2016 | July 14, 2026 | None — no ESU program exists |
| SharePoint Server 2019 | July 14, 2026 | None — no ESU program exists |
| SharePoint Server Subscription Edition | Actively supported | n/a — this is the on-premises destination |
Five SharePoint versions are now past end of life on our SharePoint lifecycle page. Two of them crossed the line a week ago.
Why the timing matters more than the CVE
Read CVE-2026-58644 as a data point rather than an emergency and it tells you the base rate. SharePoint on-premises has been a sustained target all year: CISA has flagged multiple actively exploited SharePoint flaws in recent months — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and now CVE-2026-58644 — and issued a dedicated SharePoint hardening alert on July 14. This is a platform that attracts a steady stream of critical, exploited-in-the-wild vulnerabilities, because it is internet-facing, holds the documents worth stealing, and sits inside the Windows identity fabric.
That base rate does not fall to zero because a support date passed. Only the response does.
The honest way to state the risk is not "your SharePoint is now insecure" — on July 21 a fully patched 2019 farm is exactly as secure as it was on July 13. It's this: the clock started. Every day from here, the probability that a new critical SharePoint flaw has been disclosed goes up, and your ability to do anything about it stays at zero. Based on this year's cadence, you should not be planning around if.
The three destinations, honestly compared
There are only three real answers, and the right one depends mostly on how much of your SharePoint is customization you cannot give up.
| Path | Best when | The catch |
|---|---|---|
| SharePoint Server Subscription Edition | You need on-premises, and you have farm solutions or data-residency constraints that rule out cloud | Licensing moves to a subscription; you're signing up to stay current continuously rather than every 3–5 years |
| SharePoint Online (Microsoft 365) | Your usage is mostly document libraries, sites and collaboration | Full-trust farm solutions don't come with you; heavily customized sites need rebuilding, which is where timelines slip |
| Another platform | SharePoint was never a great fit and this deadline is the forcing function | Longest path — realistic only if you've already been drifting off SharePoint |
And whatever you choose, do this today: if an on-premises SharePoint 2016 or 2019 farm is reachable from the public internet, take it off. Migration is a quarter of work; removing internet exposure is an afternoon, and it converts an unpatchable internet-facing target into an unpatchable internal one. That is a genuine reduction in risk while the real project runs.
The general lesson, for the next one of these
SharePoint's July 14 is a clean illustration of something we keep coming back to: an end-of-support date changes nothing about your software and everything about your options. The code is identical the day after. The attackers are identical. What disappears is the fix.
Two practical habits follow. First, check whether a product has an ESU-style escape hatch before you assume the deadline is soft — Windows conditioned a lot of people to expect one, and most products don't have it. Second, treat the last scheduled patch date, not the last release date, as the number in your planning; the useful question is "when does the flow of fixes stop," and for 2016 and 2019 the answer turned out to be the same Tuesday a 9.8 was landing.
The next deadlines in this class are already visible on the H2 2026 calendar. Check any version in seconds, scan your whole stack, or read our full SharePoint 2016/2019 end-of-life guide — all against dates verified against vendor sources.
Frequently Asked Questions
Is there an ESU program for SharePoint Server 2016 or 2019?
No. Unlike Windows 10 and Windows Server, SharePoint Server has no Extended Security Updates program. July 14, 2026 was a hard cutoff — no security updates at any price, from Microsoft or anyone else, because no third party can patch proprietary SharePoint code. Subscription Edition remains supported.
What is CVE-2026-58644?
A critical deserialization of untrusted data flaw (CWE-502) in SharePoint Server, CVSS 9.8, allowing remote code execution with low attack complexity. Microsoft published the advisory and fixes on July 14, 2026 and confirmed exploitation in the wild before patches shipped. CISA added it to the KEV catalog on July 16 with a July 19 federal remediation deadline. Affects SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition.
Did 2016 and 2019 get the patch?
Yes — Microsoft shipped fixes for all three affected versions on July 14. For 2016 and 2019 it was the final security update of their supported lifetime, released the same day support ended. The next comparable flaw will be fixed only in Subscription Edition.
I'm still on 2016 or 2019. What do I do this week?
Apply the July 14 updates if you haven't — they fix a flaw under active attack. Then check for prior compromise, since attackers have been stealing IIS machine keys for persistence that patching doesn't remove. Then get the farm off the public internet. Then pick a destination: Subscription Edition, SharePoint Online, or another platform.
Is unpatched SharePoint really that risky, or is this overblown?
The risk is real but it accumulates rather than arriving. A fully patched 2019 farm today is as secure as it was before the deadline. What changed is that every future disclosure is permanent for you. Given that CISA flagged four separate actively exploited SharePoint flaws in recent months, planning around "there will be another one" is the realistic posture.