CVE-2026-65660
highpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · CSIRT-IEEPSS 0.021 · 82 %ileexploit · PoCDEEUNLRUUSadded 2026-09-25remediate by 2026-09-28
required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
EU KEVflagged by CSIRT-IEreported 2026-09-25
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a user network
EPSS · scored 2026-10-24
Microsoft SharePoint Code Injection Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedMicrosoft SharePoint Enterprise Server 2016msrc_csaf
16.0.5565.1001:Security Update:https://support.microsoft.com/help/5002905
https://support.microsoft.com/help/5002905 - FixedMicrosoft SharePoint Server 2019msrc_csaf
16.0.10417.20198:Security Update:https://support.microsoft.com/help/5002894
https://support.microsoft.com/help/5002894 - FixedMicrosoft SharePoint Server Subscription Editionmsrc_csaf
16.0.19725.20522:Security Update:https://support.microsoft.com/help/5002893
https://support.microsoft.com/help/5002893
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- HORKimhab/CVE-2026-65660CVE-2026-65660 - Draft or TODOPoC · poc_in_github
affected products (73)
Products and version ranges known to be affected.
- Microsoft Azure SQL Managed Instanceall versionscert_bundDEcpe:/a:microsoft:azure:sql_managed_instance
- Microsoft Service Bus Azure Service Busall versionscert_bundDEcpe:/a:microsoft:service_bus:azure_service_bus
- Microsoft SharePoint Enterprise Server 2016all versionscert_bundDEcpe:/a:microsoft:sharepoint:enterprise_server_2016
- Microsoft SharePoint Server Subscription Editionall versionscert_bundDEcpe:/a:microsoft:sharepoint:server_subscription_edition
advisories (3)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0286Kwetsbaarheden verholpen in Microsoft OfficeNL2026-08-11csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in diverse Office producten.
- WID-SEC-W-2026-2762Microsoft Office Produkte: Mehrere SchwachstellenDeutsch2026-08-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Office Produkte ausnutzen, um Dateien zu manipulieren, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
- msrc_CVE-2026-65660Microsoft SharePoint Server Remote Code Execution Vulnerability2026-08-11csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan