What’s Vulnerable › Vulnerabilities

CVE-2026-65660: Microsoft SharePoint Server Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-09-25
• EPSS: 8.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-30
• Weakness: CWE-94

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Summary

CVE-2026-65660 is a high-severity code injection flaw (CVSS 8.8) in Microsoft SharePoint that lets an authorized attacker execute code over the network. It affects Microsoft SharePoint Server and is fixed in version 16.0.19725.20522. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates an 8.2% chance of exploitation in 30 days. Apply the vendor fix or mitigations per CISA BOD 26-04 guidance, assess internet exposure, and discontinue use if mitigations are unavailable.

CVE-2026-65660 ثغرة حقن تعليمات برمجية عالية الخطورة (CVSS 8.8) في Microsoft SharePoint تتيح لمهاجم مصرح له تنفيذ تعليمات برمجية عبر الشبكة. تؤثر الثغرة في Microsoft SharePoint Server وتُعالَج في الإصدار 16.0.19725.20522. وهي مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 8.2%. طبّق إصلاح المورّد أو التخفيفات وفق إرشادات CISA BOD 26-04، وقيّم تعرّض الأصول للإنترنت، وتوقف عن استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Microsoft SharePoint Server: before 16.0.19725.20522; 2016, 2019 — fixed in 16.0.19725.20522
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.19725.20522 — fixed in 16.0.19725.20522
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5565.1001 — fixed in 16.0.5565.1001
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20198 — fixed in 16.0.10417.20198

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.19725.20522; Microsoft SharePoint Server Subscription Edition 16.0.19725.20522; Microsoft Sharepoint Enterprise Server 2016 16.0.5565.1001; Microsoft SharePoint Server 16.0.10417.20198. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
• https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660

Get alerted when CVE-2026-65660 or the next vulnerability affects your stack