{"id":"CVE-2026-65660","kind":"vulnerability","aliases":["CVE-2026-65660"],"related":[],"title":"microsoft sharepoint server: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized…","description":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"SharePoint Server code injection (CWE-94, CVSS 8.8): a low-privileged authenticated user can run code on the server over the network. Patched Aug 11, 2026; exploited in the wild (CISA KEV Sep 25). Chained with other SharePoint flaws it gives pre-auth RCE where anonymous access is allowed. Server 2016 and 2019 are end of life since Jul 15, 2026.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-25T00:00:00+00:00","products":[{"name":"Microsoft SharePoint","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"SharePoint Enterprise Server 2016","fixed":["16.0.5565.1001"],"affected":"< 16.0.5565.1001","ecosystem":"vendor"},{"name":"SharePoint Server 2019","fixed":["16.0.10417.20198"],"affected":"< 16.0.10417.20198","ecosystem":"vendor"},{"name":"SharePoint Server Subscription Edition","fixed":["16.0.19725.20522"],"affected":"< 16.0.19725.20522","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":["16.0.19725.20522"],"affected":"< 16.0.19725.20522","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2016","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2019","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-365","self-hosted","sharepoint","vendor"],"not_affected_if":["managed-hosting","sharepoint-online"],"how_to_check":"On-prem SharePoint only. Check the farm build (Central Administration > Upgrade and Migration > Check product and patch installation status, or Get-SPFarm | select BuildVersion). Exposed if build is below 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) or 16.0.19725.20522 (Subscription Edition). Hunt for unexpected web part changes, webshells, access to IIS machine keys, deserialization activity, and Defender/AMSI SharePoint detections.","fix":"Install the August 11, 2026 security update: 2016 to 16.0.5565.1001, 2019 to 16.0.10417.20198, Subscription Edition to 16.0.19725.20522 (KB5002893 for Subscription Edition). Also enable AMSI integration with Request Body Scan Mode Full, restrict internet exposure and Central Admin, enforce MFA for admins. 2016/2019 are EOL, so plan migration.","status":"resolved","published_at":"2026-08-11T17:18:54+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:09+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T19:50:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's mitigations and security update for CVE-2026-65660 as CISA directs; discontinue use of the product if mitigations are unavailable. Sources do not name affected or fixed versions.","summary":"Microsoft SharePoint has a code injection flaw that lets an authorized attacker run code on the server over the network. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["sharepoint","self-hosted","microsoft-365"],"confidence":0.6,"analyst_note":"Find Microsoft's advisory for CVE-2026-65660 for affected builds, fixed versions, and detection steps; the KEV entry gives no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000363,"input_tokens":2182,"output_tokens":289,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-65660 for affected builds, fixed versions, and detection steps; the KEV entry gives no versions.","search":"'-04':154C,180C,211C '-2026':20A,23A '-365':49B '-65660':21A,24A '-94':60B '11':80B '15':116B '2016':30A,107B '2019':33A,109B '2026':81B,117B '25':89B '26':153C,179C,210C '8.8':62B 'access':103B 'accord':143C 'action':139C 'adher':207C 'allow':16A,105B,127C 'anonym':102B 'appli':140C 'applic':177C 'asset':201C 'attack':130C 'aug':79B 'auth':99B 'authent':67B 'author':18A,129C 'base':158C 'bod':152C,178C,209C 'chain':90B 'cisa':86B,137C,150C,167C 'cloud':183C 'code':9A,10A,57B,71B,122C,133C 'complianc':148C 'contain':120C 'control':5A 'could':126C 'cve':19A,22A 'cvss':61B 'cwe':59B 'discontinu':186C 'edition':37A 'end':111B 'ensur':147C,206C 'enterprise':28A 'evalu':199C 'execut':132C 'exploit':47B,82B 'exposur':204C 'flaw':94B 'follow':176C 'forens':169C 'generat':7A 'give':96B 'guidanc':165C,181C 'guidelin':213C 'host':52B 'improp':4A 'inject':11A,58B,123C 'instruct':146C 'internet':203C 'jul':115B 'kev':87B 'life':113B 'low':65B 'low-privileg':64B 'microsoft':1A,13A,25A,38A,41A,44A,48B,118C 'mitig':141C,192C 'network':77B,136C 'note':164C,175C 'offic':14A 'patch':78B,212C 'pre':98B 'pre-auth':97B 'priorit':155C 'privileg':66B 'product':190C 'rce':100B 'requir':138C,171C 'respons':197C 'risk':160C 'run':70B 'secur':156C 'see':161C,172C 'self':51B 'self-host':50B 'sep':88B 'server':3A,29A,32A,35A,40A,43A,46A,56B,74B,106B 'servic':184C 'sharepoint':2A,15A,26A,27A,31A,34A,39A,42A,45A,53B,55B,93B,119C 'sinc':114B 'stakehold':195C 'subscription':36A 'triag':170C 'unavail':194C 'updat':157C 'url':162C,173C 'use':187C 'user':68B 'vendor':54B,145C 'vulner':124C 'wild':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-11T17:18:54+00:00","kev":{"dateAdded":"2026-09-25","dueDate":"2026-09-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-65660","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660","severity":null,"published_at":"2026-09-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-65660:11","url":null,"severity":null,"published_at":"2026-10-23T20:24:08+00:00","modified_at":"2026-10-23T20:24:08+00:00","first_seen_at":"2026-10-23T20:24:08+00:00","fetched_at":"2026-10-23T20:24:08+00:00","note":"Fixed builds from CVE record and Cyber Centre AL26-023 (Microsoft MSRC page itself not read); exploited per CISA KEV 2026-09-25 and Microsoft via NHS; no public PoC found; chains with other SharePoint bugs for pre-auth RCE."},{"source":"nvd","external_id":"CVE-2026-65660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65660","severity":null,"published_at":"2026-08-11T17:18:54+00:00","modified_at":"2026-09-26T04:17:45+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":824,"url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660","title":"Cyber Centre AL26-023 SharePoint CVE-2026-65660","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":826,"url":"https://www.cve.org/CVERecord?id=CVE-2026-65660","title":"CVE Record CVE-2026-65660","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":825,"url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4859","title":"NHS England CC-4859","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}