CVE-2026-65660

Microsoft SharePoint Server Remote Code Execution Vulnerability

Exploited in the wild. In CISA KEV since 2026‑09‑25. A vendor fix is available.

CVSS 3.18.8High EPSS percentile67th1.2% chance in 30 days CISA KEVListedsince 2026-09-25, due 2026-09-28
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-09-26Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your installed Microsoft SharePoint Server version and whether it matches an affected release.
Compare your version to the vendor’s fixed versions for each product (upgrade any branch that is still below the fix).
Install the Microsoft security update for CVE-2026-65660 as soon as possible.
If you cannot patch immediately, restrict who can reach SharePoint and tightly limit/monitor authenticated access until you upgrade.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

In plain language

Written by AI from the record

If you run Microsoft SharePoint Server (2016/2019/Subscription Edition) and an attacker has an authorized account, this vulnerability lets them spoof (impersonate) other users or systems over the network, leading to serious possible data exposure—so you should patch.

CVE-2026-65660 is an authenticated network spoofing issue in Microsoft SharePoint that allows an authorized attacker to inject code and impersonate other users/systems across the network, driving high confidentiality loss via spoofing.

If you're affected

Impersonation of accounts
Customer or company data exposure
Unauthorized actions in SharePoint
Reputation and compliance risk

What is it

Think of SharePoint like your office’s shared filing system and identity directory. This flaw can let a legitimate (already authorized) attacker trick SharePoint into pretending to be other people or systems, which can expose files or let them do things they shouldn’t. It doesn’t require employees to click anything—an attacker just needs the ability to authenticate to SharePoint.

Who is affected

This matters if your business runs Microsoft SharePoint Server (including Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition). Because the attacker must be an authorized user, the risk is highest if someone can sign in (for example, via stolen credentials or an overly-permissive account). Only a risk if an attacker already has an account that can reach and use SharePoint (authentication is required).

How urgent is it

This is RED because it enables authenticated spoofing that can lead to high confidentiality loss, and patch attention is fresh. Even though there’s no confirmed KEV entry in the provided sources and no public exploit code on record, you should treat it as an urgent patch for any environment that’s reachable by authenticated users.

What to do — in detail

Inventory and confirm exposure
- Identify which SharePoint product you run: SharePoint Server, SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition.
- Record the exact SharePoint build/version currently installed.
Determine whether you’re on an affected version
- Compare your current build against the vendor-fixed versions:
  - SharePoint Server → fixed in 16.0.19725.20522
  - SharePoint Enterprise Server 2016 → fixed in 16.0.5565.1001
  - SharePoint Server 2019 → fixed in 16.0.10417.20198
  - SharePoint Server Subscription Edition → fixed in 16.0.19725.20522
- If your build is older than the relevant fixed build, you should assume you’re affected.
Apply the patch
- Install Microsoft’s security update for CVE-2026-65660 from Microsoft’s update guide.
- After installation, re-check the SharePoint build number to confirm it matches (or is higher than) the fixed version for your edition.
If patching is delayed (temporary containment)
- Reduce who can authenticate to SharePoint (least privilege for SharePoint users; disable stale accounts; tighten group memberships).
- Restrict network paths to SharePoint so only required users/addresses can reach it.
- Increase monitoring for suspicious authenticated behavior (for example, unusual user impersonation patterns, unexpected access to sensitive libraries, or abnormal changes to permissions/identity-related features).
What to monitor after upgrade
- Continued integrity of access patterns (no sudden spikes in unusual downloads/reads by atypical accounts).
- Permission and identity-related changes in SharePoint.
- Any SharePoint/application logs related to spoofing or code-generation related failures (as supported by your environment).

Note: CISA KEV status is not listed in the provided sources, and no dated “actively exploited in the wild” claim is included here. The provided press summary indicates broader Patch Tuesday activity, but it does not specifically document this CVE being exploited.

Technical context

Severity/impact: The weakness is CWE-94 (Code Injection). In plain terms, an authenticated attacker can trigger code injection behavior that enables spoofing—impersonating other users or systems—over the network, resulting in high confidentiality loss (while availability impact is not indicated in the findings).

Mechanism and prerequisites: The findings state authentication is required, no user interaction is needed, and the attacker must be an authorized user. The attack vector is network-based.

Exploitation status: CISA KEV is not listed for this CVE in the provided sources, and there is no public exploit code on record. Press reporting in the provided sources does not clearly claim exploitation for CVE-2026-65660.

Patch information: Fixed versions are provided for each SharePoint variant (16.0.19725.20522; 16.0.5565.1001; 16.0.10417.20198). Microsoft has published remediation guidance for CVE-2026-65660.

Threat note: The provided PULSE summary mentions actor interest (Lazarus group) in the context of patch attention; treat this as heightened attention, not proof of exploitation of this exact CVE.

Predicted likelihood: An EPSS prediction is present in the findings, but it is not used as a basis for the urgency decision here given the RED verdict.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS67th

CISA KEV

Listed as exploited in the wild since 2026-09-25.

US federal agencies must remediate by 2026-09-28.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.2% chance of exploitation activity in the next 30 days, which ranks it in the 67th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by added to CISA KEV.

Lifecycle

19 events over 46 days, from the signal feeds we watch.

2026-09-26Patch availablerecord updated
2026-09-25Added to CISA KEVpatch available, patch available, record updated, record updated
2026-09-24Patch availablerecord updated
2026-08-27Patch availablerecord updated
2026-08-15OpenVAS check added
2026-08-13Patch availablerecord updated

Affected products

Microsoftcommercial · US
- sharepoint serverWeb AppOn-premEnterprise Software / collaboration-groupware
- Microsoft SharePoint Enterprise Server 2016Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionWeb AppOn-premEnterprise Software / collaboration-groupware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable