CVE-2026-65658

This bug lets a person with a valid account on your SharePoint system send “crafted” data that SharePoint mishandles. In the worst case, that can cause SharePoint to run attacker-controlled code on the server, like getting an intruder to execute a script inside your building system.

This matters if you run Microsoft SharePoint Server, including Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The risk is tied to an attacker being able to authenticate with valid SharePoint credentials, and there’s no need for a user to click anything.

This should be treated as urgent because the flaw can enable remote execution of malicious code once an attacker has valid credentials. Even though no specific dated public exploitation details are provided here, the risk level remains high due to the code execution impact and the actor interest reported (Lazarus group).

1. Identify your environment

   • Determine the exact SharePoint Server product/edition and current patch/build number.
   • Confirm whether the server is publicly reachable and whether the SharePoint sign-in surface is exposed to the internet.

2. Check whether you’re already fixed

   • Compare your current build to the fixed versions:
     • SharePoint Server: fixed in 16.0.19725.20522
     • Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
     • Microsoft SharePoint Server 2019: fixed in 16.0.10417.20198
     • Microsoft SharePoint Server Subscription Edition: fixed in 16.0.19725.20522

3. Upgrade/patch plan

   • Apply the Microsoft-provided update for CVE-2026-65658 from the vendor update guide.
   • Schedule downtime windows as required by your patching process, and test in a staging environment if you have one.
   • Ensure all relevant SharePoint components/services on that farm are included in the update procedure (follow Microsoft’s update guidance for your topology).

4. If patching is delayed (temporary containment)

   • Reduce the set of identities that can sign in to SharePoint (remove unused accounts, review access groups).
   • Restrict network access to SharePoint so fewer paths can reach it (for example, limit from internet only where absolutely required).
   • Increase monitoring focus on:
     • New or suspicious SharePoint logins
     • Unusual admin actions
     • Unexpected application/service behavior after login attempts

5. After patching

   • Confirm the SharePoint build number reflects the target fixed version.
   • Review recent access and server activity logs for anomalies around the time of patch deployment.

CVE-2026-65658 is a high-severity Microsoft SharePoint Server remote code execution vulnerability (CWE-502). The mechanism described in the findings is insecure handling of received data structures: the server reconstructs untrusted data without proper safety checks, allowing an authenticated attacker to execute arbitrary malicious code over the network, with no user interaction required.

Exploit maturity: no public exploit code was found in the supplied findings. There is no CISA KEV listing in the supplied findings, and no dated incident/exploitation reports are provided here for this specific CVE. However, the actor/press monitoring signal (Lazarus group) indicates security interest, so prioritize remediation.

Fixed versions are available per product/edition, and patching should be applied to reach the listed builds.