{"id":"sharepoint-code-injection-cve-2026-65660-sep-2026","category":"patch","status":"closed","title":"Microsoft SharePoint Server code injection flaw CVE-2026-65660 exploited; fixed in August updates","tldr":"Attackers are exploiting CVE-2026-65660 in on-premises SharePoint Server 2016, 2019 and Subscription Edition to run code. Microsoft fixed it in August. IT teams should install the August updates and check the June ones. SharePoint Online is not listed as affected.","summary":"CVE-2026-65660 is a code injection flaw in the web part handling of on-premises Microsoft SharePoint Server. Someone with a valid, low-privileged account can use it to run their own code on the server. Microsoft released fixes in its August 2026 updates and first labelled it a spoofing flaw with a CVSS score of 6.5. Researchers published the root cause and proof-of-concept code on 22 September, and CISA added the flaw to its list of exploited vulnerabilities on 25 September. The record now rates it CVSS 8.8. Field Effect reports that attackers can chain it with an earlier, already-fixed SharePoint login bypass to attack servers that allow anonymous access without any account. Fixed builds exist for SharePoint 2016, 2019 and Subscription Edition, although 2016 and 2019 reached end of life on 15 July 2026. SharePoint Online is not listed as affected. No group has been publicly named as responsible, according to the sources read.","action":"If you run SharePoint Server yourself, install the August 2026 updates (builds 16.0.5565.1001 for 2016, 16.0.10417.20198 for 2019, 16.0.19725.20522 for Subscription Edition) and confirm the June 2026 updates are on too. Families using Microsoft 365 or SharePoint Online have nothing to do.","product":"Microsoft SharePoint Server (on-premises) 2016, 2019 and Subscription Edition","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-65660"],"tags":["microsoft","sharepoint","code-injection","cisa-kev","exploited","on-premises","business"],"affected":["Microsoft SharePoint Enterprise Server 2016 before 16.0.5565.1001","Microsoft SharePoint Server 2019 before 16.0.10417.20198","Microsoft SharePoint Server Subscription Edition before 16.0.19725.20522"],"fixed":["16.0.5565.1001 (SharePoint Enterprise Server 2016)","16.0.10417.20198 (SharePoint Server 2019)","16.0.19725.20522 (SharePoint Server Subscription Edition)"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft Security Update Guide: CVE-2026-65660","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660","by":"Microsoft","date":"2026-08-11"},{"kind":"advisory","title":"Alert AL26-023: Vulnerability impacting Microsoft SharePoint Server (CVE-2026-65660)","url":"https://cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660","by":"Canadian Centre for Cyber Security","date":"2026-09-24"},{"kind":"news","title":"SharePoint vulnerability exploited","url":"https://fieldeffect.com/blog/sharepoint-vulnerability-exploited","by":"Field Effect","date":"2026-09-25"}],"started":"2026-09-25","closed":"2026-09-25","created":"2026-11-03T22:06:52.157Z","updated":"2026-11-03T22:06:52.157Z","cve_notes":[{"cve":"CVE-2026-65660","name":"Code injection in SharePoint Server web part handling","what":"A code injection flaw in how on-premises SharePoint handles web part markup that lets a logged-in attacker with a low-privileged account run code on the server, and in some set-ups without an account when chained with an earlier fixed bypass.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-09-25","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog, now described as a code injection flaw rated CVSS 8.8 that lets an authenticated user run code.","url":"https://fieldeffect.com/blog/sharepoint-vulnerability-exploited","by":"Field Effect","patch":null},{"at":"2026-09-24","added":"2026-11-03T22:05:25.250Z","kind":"other","text":"The Canadian Centre for Cyber Security issued alert AL26-023, saying it was aware of active exploitation and urging upgrades to builds 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) and 16.0.19725.20522 (Subscription Edition). It noted that SharePoint 2016 and 2019 reached end of life on 15 July 2026.","url":"https://cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-09-22","added":"2026-11-03T22:05:25.250Z","kind":"wider-attacks","text":"Researchers published the root cause and proof-of-concept code. Monitoring providers reported attempts against vulnerable servers within days.","url":"https://fieldeffect.com/blog/sharepoint-vulnerability-exploited","by":"Field Effect","patch":null},{"at":"2026-08-11","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"Microsoft released fixes for CVE-2026-65660 in its August security updates for SharePoint Server 2016, 2019 and Subscription Edition. It was first described as a spoofing flaw with a CVSS score of 6.5.","url":"https://fieldeffect.com/blog/sharepoint-vulnerability-exploited","by":"Field Effect","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-code-injection-cve-2026-65660-sep-2026/","json":"https://hard.fyi/api/live?id=sharepoint-code-injection-cve-2026-65660-sep-2026"}