--- id: "CVE-2026-65660" kind: "vulnerability" aliases: ["CVE-2026-65660"] title: "microsoft sharepoint server: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized\u2026" severity: "high" cvss: 8.8 epss: null exploited: true status: "resolved" category: "vendor" products: [{"name": "Microsoft SharePoint", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "SharePoint Enterprise Server 2016", "fixed": ["16.0.5565.1001"], "affected": "< 16.0.5565.1001", "ecosystem": "vendor"}, {"name": "SharePoint Server 2019", "fixed": ["16.0.10417.20198"], "affected": "< 16.0.10417.20198", "ecosystem": "vendor"}, {"name": "SharePoint Server Subscription Edition", "fixed": ["16.0.19725.20522"], "affected": "< 16.0.19725.20522", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": ["16.0.19725.20522"], "affected": "< 16.0.19725.20522", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2016", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2019", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "microsoft-365", "self-hosted", "sharepoint", "vendor"] not_affected_if: ["managed-hosting", "sharepoint-online"] published_at: "2026-08-11T17:18:54+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:24:08+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65660", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # microsoft sharepoint server: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized… SharePoint Server code injection (CWE-94, CVSS 8.8): a low-privileged authenticated user can run code on the server over the network. Patched Aug 11, 2026; exploited in the wild (CISA KEV Sep 25). Chained with other SharePoint flaws it gives pre-auth RCE where anonymous access is allowed. Server 2016 and 2019 are end of life since Jul 15, 2026. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Microsoft SharePoint affected ? fixed ? - vendor:SharePoint Enterprise Server 2016 affected < 16.0.5565.1001 fixed 16.0.5565.1001 - vendor:SharePoint Server 2019 affected < 16.0.10417.20198 fixed 16.0.10417.20198 - vendor:SharePoint Server Subscription Edition affected < 16.0.19725.20522 fixed 16.0.19725.20522 - vendor:microsoft sharepoint server affected < 16.0.19725.20522 fixed 16.0.19725.20522 - vendor:microsoft sharepoint server affected = 2016 fixed ? - vendor:microsoft sharepoint server affected = 2019 fixed ? ## How to check On-prem SharePoint only. Check the farm build (Central Administration > Upgrade and Migration > Check product and patch installation status, or Get-SPFarm | select BuildVersion). Exposed if build is below 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) or 16.0.19725.20522 (Subscription Edition). Hunt for unexpected web part changes, webshells, access to IIS machine keys, deserialization activity, and Defender/AMSI SharePoint detections. ## Fix Install the August 11, 2026 security update: 2016 to 16.0.5565.1001, 2019 to 16.0.10417.20198, Subscription Edition to 16.0.19725.20522 (KB5002893 for Subscription Edition). Also enable AMSI integration with Request Body Scan Mode Full, restrict internet exposure and Central Admin, enforce MFA for admins. 2016/2019 are EOL, so plan migration. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660 - 2026-10-23T20:24:08+00:00 analyst — Fixed builds from CVE record and Cyber Centre AL26-023 (Microsoft MSRC page itself not read); exploited per CISA KEV 2026-09-25 and Microsoft via NHS; no public PoC found; chains with other SharePoint bugs for pre-auth RCE. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65660 ## Documents - [advisory] Cyber Centre AL26-023 SharePoint CVE-2026-65660 https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660 - [describes] NHS England CC-4859 https://digital.nhs.uk/cyber-alerts/2026/cc-4859 - [fix] CVE Record CVE-2026-65660 https://www.cve.org/CVERecord?id=CVE-2026-65660 ## From the sources Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_