Microsoft SharePoint Code Injection (CVE-2026-65660)

Catalog analysis: CISA added this entry on September 25, 2026. The entry reflects catalog information retrieved on September 25, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-65660 is a code injection vulnerability (CWE-94) affecting Microsoft SharePoint. The flaw allows an authorized attacker to execute arbitrary code over a network. Because this vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, it is confirmed to be actively exploited in the wild.

Exposure and applicability

This vulnerability applies to organizations deploying Microsoft SharePoint. The primary exposure path involves network-based access by an authorized user. Security leaders should prioritize assets that are internet-facing or reside in high-trust zones where compromised authorized accounts could facilitate lateral movement.

Remediation priorities

Based on the active exploitation status, our analysis suggests the following prioritization for vulnerability management teams:

1. Immediate Patching: Apply the mitigations provided in the vendor’s official instructions. This is the primary method to address the underlying code injection flaw.
2. Exposure Assessment: Evaluate all SharePoint instances for internet exposure. Assets reachable from the public web should be prioritized for immediate remediation due to increased risk of discovery and exploitation.
3. Forensic Triage: Because CISA has flagged this vulnerability for forensic triage, defenders should examine logs for signs of unauthorized code execution prior to and during the patching process. Applying a patch does not remove an attacker who may have already gained access.

How to validate remediation

To ensure that exposure has been reduced, organizations must move beyond simple version checks. We recommend the following validation steps:

• Configuration Audit: Verify that the specific updates or configuration changes mandated by the vendor are active across all SharePoint nodes in the environment.
• Access Review: Since the vulnerability requires an authorized attacker, auditing account permissions and implementing the principle of least privilege can reduce the pool of potential attackers capable of triggering the flaw.
• Verification of Result: Confirm that the mitigation is effective through authorized security testing or by verifying the successful application of the vendor’s specific fix via official management tools. A version number change indicates a patch was attempted, but it does not prove the vulnerability is mitigated in the running environment.

Limits and open questions

There are several unknowns that impact the risk profile: the source does not specify if this flaw is being utilized by known ransomware campaigns. Additionally, while patching addresses the vulnerability, residual risk remains if an attacker has already established persistence within the SharePoint environment. Defenders must treat the remediation as a two-part process: closing the entry point and verifying the integrity of the system.

Source and editorial note

CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability · Source date: September 25, 2026 · Retrieved September 25, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment