NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Microsoft SharePoint Server code injection flaw CVE-2026-65660 exploited; fixed in August updates

Attackers are exploiting CVE-2026-65660 in on-premises SharePoint Server 2016, 2019 and Subscription Edition to run code. Microsoft fixed it in August. IT teams should install the August updates and check the June ones. SharePoint Online is not listed as affected.

What to do

If you run SharePoint Server yourself, install the August 2026 updates (builds 16.0.5565.1001 for 2016, 16.0.10417.20198 for 2019, 16.0.19725.20522 for Subscription Edition) and confirm the June 2026 updates are on too. Families using Microsoft 365 or SharePoint Online have nothing to do.

What’s happening

CVE-2026-65660 is a code injection flaw in the web part handling of on-premises Microsoft SharePoint Server. Someone with a valid, low-privileged account can use it to run their own code on the server. Microsoft released fixes in its August 2026 updates and first labelled it a spoofing flaw with a CVSS score of 6.5. Researchers published the root cause and proof-of-concept code on 22 September, and CISA added the flaw to its list of exploited vulnerabilities on 25 September. The record now rates it CVSS 8.8. Field Effect reports that attackers can chain it with an earlier, already-fixed SharePoint login bypass to attack servers that allow anonymous access without any account. Fixed builds exist for SharePoint 2016, 2019 and Subscription Edition, although 2016 and 2019 reached end of life on 15 July 2026. SharePoint Online is not listed as affected. No group has been publicly named as responsible, according to the sources read.

What
Flaw
Affects
Microsoft SharePoint Server (on-premises) 2016, 2019 and Subscription Edition
Affected
Microsoft SharePoint Enterprise Server 2016 before 16.0.5565.1001
Microsoft SharePoint Server 2019 before 16.0.10417.20198
Microsoft SharePoint Server Subscription Edition before 16.0.19725.20522
Fixed in
16.0.5565.1001 (SharePoint Enterprise Server 2016)
16.0.10417.20198 (SharePoint Server 2019)
16.0.19725.20522 (SharePoint Server Subscription Edition)
CVE
CVE-2026-65660
Since
25 Sept 2026
Closed
25 Sept 2026

Timeline

  1. CISA added

    CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog, now described as a code injection flaw rated CVSS 8.8 that lets an authenticated user run code.

  2. Update

    The Canadian Centre for Cyber Security issued alert AL26-023, saying it was aware of active exploitation and urging upgrades to builds 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) and 16.0.19725.20522 (Subscription Edition). It noted that SharePoint 2016 and 2019 reached end of life on 15 July 2026.

  3. Wider attacks

    Researchers published the root cause and proof-of-concept code. Monitoring providers reported attempts against vulnerable servers within days.

  4. Made publicFixed

    Microsoft released fixes for CVE-2026-65660 in its August security updates for SharePoint Server 2016, 2019 and Subscription Edition. It was first described as a spoofing flaw with a CVSS score of 6.5.

Sources

  1. Microsoft Security Update Guide: CVE-2026-65660Microsoft · 11 Aug 2026
  2. Alert AL26-023: Vulnerability impacting Microsoft SharePoint Server (CVE-2026-65660)Canadian Centre for Cyber Security · 24 Sept 2026
  3. SharePoint vulnerability exploitedField Effect · 25 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS