CVE Intelligence
Analysis AI-assisted

CVE-2026-65660: Microsoft SharePoint Code Injection (CWE-94)

Microsoft has published CVE-2026-65660, a code injection weakness (CWE-94) in Microsoft Office SharePoint Server that the record says allows an authorized attacker to execute code over a network. The CNA rates it high with a base score of 8.8, and CISA lists it in the Known Exploited Vulnerabilities catalog. Administrators should verify affected builds and apply the vendor update as a priority.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Microsoft has published a CVE record for a code injection weakness (CWE-94) in Microsoft Office SharePoint Server. The record describes it as allowing an authorized attacker to execute code over a network. The CNA rates it high with a base score of 8.8, and the official patch guidance is in the MSRC update guide.

Impact

  • The CNA rates confidentiality, integrity and availability impact as high under the vector given in the record.
  • Code execution on a SharePoint server could expose or alter the content and services hosted on it (inference from the description and vector).

Affected products and versions

  • Microsoft SharePoint Enterprise Server 2016: from 16.0.0 up to before 16.0.5565.1001.
  • Microsoft SharePoint Server 2019: from 16.0.0 up to before 16.0.10417.20198.
  • Microsoft SharePoint Server Subscription Edition: from 16.0.0 up to before 16.0.19725.20522.
  • The record also contains a generic entry for SharePoint Server before 16.0.19725.20522, plus the labels version 2016 and version 2019 without further detail.

The upper bounds appear to correspond to fixed builds, but the record does not state this explicitly. Confirm the fixed build for each edition in the vendor advisory.

Exploitation status

The CVE is listed in the CISA Known Exploited Vulnerabilities catalog, with a date added of 2026-09-25, so exploitation in the wild is confirmed by that listing. The SSVC data in the record marks exploitation as active and automatable as no. A third-party blog referenced in the record has a title describing two-stage exploitation attempts; the record provides only that title, so its details were not verified here. Ransomware use is recorded as unknown.

Remediation and mitigation

  • Apply the vendor update for the affected SharePoint edition, as described in the MSRC update guide.
  • Prioritize SharePoint servers that are reachable from the internet or from broad internal networks.
  • If a patch cannot be applied immediately, follow the vendor mitigations. The KEV entry states that products should be discontinued if mitigations are unavailable.
  • Compare installed build numbers with the ranges listed above and track any systems that remain below the fixed level.

Detection guidance

  • Review SharePoint and IIS logs for unexpected requests or error patterns, and retain them for incident review.
  • Monitor for unusual processes started by SharePoint service accounts, which may indicate post-exploitation activity.
  • Maintain an up-to-date inventory of SharePoint editions and build numbers to speed up triage.

Limitations of the available information

  • The record does not describe the vulnerable component, the exact prerequisites beyond an authorized attacker, or any proof-of-concept details, and this analysis does not add them.
  • The record does not provide an explicit fixed-build list; the affected upper bounds are the closest available reference.
  • CVSS base scores differ across sources: 8.8 from two Microsoft-related providers and 6.5 from GitHub. The record does not explain the difference.
  • The EPSS probability is 0.02101 with a percentile of 0.81581, dated 2026-10-23.
  • The record lists vague version labels, so the scope for some deployments may need confirmation with the vendor.

Frequently asked questions

Is CVE-2026-65660 being exploited?

Yes, according to the record. CISA lists the CVE in its Known Exploited Vulnerabilities catalog, added on 2026-09-25, which confirms exploitation in the wild.

Which SharePoint versions are affected?

The record lists SharePoint Enterprise Server 2016 from 16.0.0 up to before 16.0.5565.1001, SharePoint Server 2019 from 16.0.0 up to before 16.0.10417.20198, and Subscription Edition from 16.0.0 up to before 16.0.19725.20522.

What should administrators do first?

Check installed build numbers against the affected ranges and apply the update from the Microsoft Security Response Center. Prioritize internet-facing servers and follow vendor mitigations if patching is delayed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.