CVE-2026-65660: Microsoft SharePoint Code Injection Allows Authorized Attacker to Execute Code Over the Network

Background

Microsoft SharePoint is the document management and intranet collaboration platform underpinning internal portals, file sharing, and workflow automation at a large share of mid-size and enterprise organizations. On-premises SharePoint Server deployments, in particular, are frequently internet-facing — exposed for extranet collaboration, partner portals, or remote employee access — which has made the product a recurring target for CISA KEV additions in recent years (CVE-2024-38094, CVE-2026-20963, CVE-2026-45659, CVE-2026-50522, and CVE-2026-55040 are all prior SharePoint entries on the same catalog).

CVE-2026-65660 is a code injection vulnerability (CWE-94) in SharePoint that allows an authorized attacker — meaning an attacker who holds some level of valid access to the application, such as a low-privileged authenticated user or a user who can reach an authenticated API surface — to execute arbitrary code on the server over the network. Because SharePoint runs with access to connected enterprise systems (Active Directory-integrated authentication, file stores, and often adjacent line-of-business integrations), server-side code execution on a SharePoint instance has downstream consequences well beyond the SharePoint application itself.

Technical Mechanism

Code injection (CWE-94) occurs when an application incorporates attacker-controlled input into a context that is later interpreted and executed as code — rather than treated purely as data. In SharePoint’s case, Microsoft’s advisory characterizes this as a server-side flaw reachable “over a network” by an “authorized attacker,” which indicates the vulnerable code path sits behind SharePoint’s authentication layer but does not require administrative privileges to reach.

A typical exploitation chain for this class of vulnerability in SharePoint looks like:

1. An attacker authenticates to the SharePoint site (or application) with any account that has the minimum access needed to reach the vulnerable endpoint — this could be a standard collaboration user, a service account, or in some historical SharePoint CVEs, an account obtained through a separate low-privilege foothold.
2. The attacker submits a crafted request — commonly through a workflow definition, a web part parameter, a custom field, or an API payload — containing a value that the server later evaluates as executable code (for example, deserialized object graphs, template expressions, or server-side script fragments) rather than as inert data.
3. The SharePoint application server parses and executes the injected payload in the context of the SharePoint application pool identity, which on many on-premises deployments runs with elevated local or domain service-account privileges.
4. The attacker gains code execution on the SharePoint server itself, which can be used to deploy a web shell, pivot to the underlying Windows Server host, or query/exfiltrate data accessible to the application pool account.

The CVSS 8.8 score is consistent with a vector requiring some level of privilege (PR:L) and no user interaction, but delivering high confidentiality, integrity, and availability impact once exploited — a profile typical of authenticated, server-side code execution bugs in enterprise web applications.

Real-World Exploitation Evidence

CVE-2026-65660’s inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog is, by definition, confirmation that CISA has observed or received credible evidence of active exploitation in the wild — KEV listing is not a theoretical-risk designation. CISA added the entry on 25 September 2026.

No specific threat actor, intrusion set, or campaign name is included in the available KEV record for this CVE. No specific threat actor has been publicly attributed to exploitation of CVE-2026-65660 at the time of this writing; its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Given SharePoint’s history as a target for both opportunistic web-shell deployment campaigns and more targeted intrusions (the ToolShell/CVE-2026-20963 family and ProxyLogon-era Exchange/SharePoint campaigns both set precedent here), defenders should not assume this is low-sophistication activity simply because attribution has not surfaced.

CISA’s required action for this entry directs agencies to apply vendor mitigations in line with Binding Operational Directive (BOD) 26-04 — CISA’s risk-based prioritization framework for security updates — and to follow the associated Forensics Triage Requirements guidance, which implies CISA considers this vulnerability to carry meaningful risk of prior compromise requiring forensic review, not just patching.

CISA’s knownRansomwareCampaignUse field for this entry is marked “Unknown” — CISA has not confirmed ransomware use of this specific CVE at this time.

Impact Assessment

A CVSS 8.8 code-execution vulnerability on a collaboration platform carries severe practical impact:

• Confidentiality: SharePoint document libraries routinely hold sensitive business records, HR files, contracts, and — depending on deployment — regulated data (PII, financial records, or protected health information). Code execution on the server grants access to everything the application pool identity can read, which in many on-premises deployments extends to file shares and databases well beyond SharePoint’s own content.
• Integrity: An attacker with code execution can modify documents, tamper with workflow logic, or plant persistent backdoors (web shells, scheduled tasks) that survive routine application restarts.
• Availability: Code execution can be leveraged to disrupt the SharePoint farm outright, or as a staging point for ransomware deployment against connected file shares.

Sector-specific risk: Organizations running on-premises SharePoint Server — rather than SharePoint Online — carry the most direct exposure, since Microsoft manages patching for the cloud service. Government agencies, legal and professional services firms, and manufacturers that rely on SharePoint extranets for partner collaboration are historically overrepresented among SharePoint KEV victims, largely because these deployments are both internet-facing and infrequently patched outside of scheduled maintenance windows.

Affected Versions

Microsoft’s advisory is the authoritative source for the exact affected builds; CISA’s KEV record does not enumerate specific version ranges. Organizations should consult the MSRC advisory linked below for the definitive affected-version list. In general terms:

Treat any on-premises SharePoint Server farm not yet updated with the September 2026 cumulative/security update as presumptively vulnerable until verified otherwise.

Remediation Steps

CISA’s required action for this entry is to apply vendor mitigations per BOD 26-04 guidance and the associated Forensics Triage Requirements, or discontinue use of the product if mitigations are unavailable.

1. Identify all on-premises SharePoint Server farms in the environment, including development, staging, and legacy farms that may be outside normal patch cadence:

Get-SPFarm | Select-Object -ExpandProperty BuildVersion
Get-SPProduct -Local

2. Apply Microsoft’s September 2026 SharePoint security update referenced in the MSRC advisory (see References) to every affected farm.

3. Follow CISA’s Forensics Triage Requirements guidance before and after patching — given CISA’s explicit reference to this guidance for the entry, assume prior compromise is a credible possibility and triage accordingly rather than patching and closing the ticket.

4. Review application pool and service account permissions — reduce the SharePoint application pool identity’s privileges to the minimum required, limiting the blast radius of any future code-execution exploit in the platform.

5. If mitigations cannot be applied promptly, restrict network exposure of the SharePoint farm (VPN-only access, IP allowlisting) as an interim measure, and escalate patching priority — per BOD 26-04, internet-exposed assets carry the highest remediation priority.

Detection Guidance

Exact detection signatures should come from Microsoft’s security advisory and your EDR/IDS vendor’s threat intelligence feed, since Microsoft has not published full technical exploitation details for this CVE publicly. General guidance for SharePoint code-injection exploitation:

• Web server / IIS logs: Review for anomalous POST requests to SharePoint API endpoints, workflow definition import/export endpoints, or custom web part configuration pages, especially from accounts that do not normally perform administrative actions.
• Process monitoring: Alert on unexpected child processes spawned by the SharePoint application pool worker process (w3wp.exe), particularly cmd.exe, powershell.exe, or unsigned binaries — a strong indicator of web-shell-based code execution following a code injection exploit.
• File integrity monitoring: Monitor SharePoint web application directories (_layouts, _vti_bin, custom solution deployment paths) for newly written .aspx or .ashx files, a common web-shell deployment pattern in prior SharePoint KEV exploitation.
• Authentication logs: Review for unusual authentication patterns on accounts that subsequently touched the vulnerable code path — particularly service accounts or low-privilege accounts exhibiting activity outside normal baselines.

Timeline

References

• Microsoft Security Response Center — CVE-2026-65660
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-65660