The short answer
CVE-2026-65660 is an actively exploited code-injection flaw in on-premises SharePoint Server that Microsoft first published as a low-impact spoofing issue. Any authenticated user with low privileges can use it to run code on the server, and chained with other SharePoint bugs it can reach pre-authentication RCE. The fix is the August 11, 2026 update. Teams that build or run custom SharePoint solutions should confirm every farm is on the patched build, not just that the patch was “scheduled.”
The wider lesson: a vendor’s severity label is an input to your triage, not the verdict. This bug sat in normal patch queues for six weeks because its first description undersold it.
What changed about CVE-2026-65660?
When Microsoft released its August 11, 2026 security updates, CVE-2026-65660 appeared in the advisory as a SharePoint Server spoofing vulnerability with a CVSS score of 6.5 and, per the advisory text, no impact on integrity or availability. The CVE record, updated on September 11, describes something very different: a remote code execution flaw, classified as CWE-94 code injection, which the National Vulnerability Database scores at 8.8.
According to The Hacker News, the bug sits in how SharePoint’s ToolPane component rebuilds web-part markup: attribute values are written between double quotes without escaping them, which lets an attacker inject server-side directives. The researcher credited with the finding, Dinh Ho Anh Khoa of Viettel Cyber Security, told the outlet the flaw can be chained with CVE-2026-55040, an authentication bypass patched in June, to reach pre-authentication RCE. The August update both fixes the flaw and disables the vulnerable function by default.
On September 24, the Canadian Centre for Cyber Security issued alert AL26-023 reporting active exploitation. A day later, CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog, alongside a MikroTik RouterOS flaw, and gave U.S. federal civilian agencies until September 28 to remediate. Neither agency has named the attackers or said how many servers were hit.
Who is exposed?
Every organization running on-premises SharePoint Server 2016, 2019 or Subscription Edition below the August 2026 builds. The attacker needs an authenticated account, but in SharePoint that bar is low: any employee, contractor or partner account with basic access will do, and so will one stolen password. Farms that allow anonymous access are at higher risk, because the chained attack path removes the login requirement.
Two groups deserve extra attention. First, companies still on SharePoint Server 2016 or 2019: both versions reached end of support in July 2026, so the August fix may be one of the last they can apply, and the next flaw may not get a patch at all. Second, teams with internet-facing SharePoint for partner portals, extranets or legacy intranets, which is exactly where exploitation starts. SharePoint Online customers in Microsoft 365 are not listed as affected.
What it means for US & EU software teams
First, triage on the flaw, not the label. Many patch policies route “spoofing, CVSS 6.5” into a monthly cycle and “RCE, CVSS 8.8” into an emergency one. Here the label changed six weeks after release, with no new patch to trigger a second look. Subscribing to CISA KEV updates and re-checking open vulnerabilities when a CVE record changes closes that gap cheaply.
Second, SharePoint holds regulated data. Contracts, HR files, customer records and board papers often live in the same farm. Code execution on that server is a likely personal-data breach, which starts the 72-hour GDPR notification clock and, for companies in NIS2 scope, a 24-hour early warning. US public companies may face an SEC disclosure within four business days if the incident is material. Patching fast matters, and so does being able to show from logs that nobody got in first.
Third, end of support turns every future flaw into a migration question. If your farm runs 2016 or 2019, plan the move to Subscription Edition or SharePoint Online now, together with the custom web parts and workflows that depend on it. That is a software modernization project, and it is cheaper to schedule than to run under incident pressure.
What should you do now?
- Check build numbers on every farm. Confirm 2016 ≥ 16.0.5565.1001, 2019 ≥ 16.0.10417.20198 and Subscription Edition ≥ 16.0.19725.20522. Include staging, disaster-recovery and forgotten departmental servers.
- Patch now, not in the next cycle. Install the August 2026 (or later) SharePoint security updates, and make sure the June update for CVE-2026-55040 is in place too.
- Cut exposure. Remove direct internet access where you can, disable anonymous access you do not need, enforce MFA for administrators and enable AMSI integration, as the Canadian Cyber Centre recommends.
- Hunt before you close the ticket. Look for unexpected web-part changes, new administrative accounts, unusual configuration changes and unknown files on SharePoint servers since August.
- Fix the process. Feed CISA KEV additions into your vulnerability management and re-triage when a vendor changes a CVE record, so the next relabeled bug does not wait six weeks.
Frequently asked questions
What is CVE-2026-65660?
CVE-2026-65660 is a code-injection vulnerability (CWE-94) in on-premises Microsoft SharePoint Server. An authenticated attacker with low privileges can execute arbitrary code on the server over the network. It is scored CVSS 8.8 in the National Vulnerability Database. Microsoft fixed it in the August 11, 2026 security updates.
Why did many teams miss it?
Microsoft’s August 11 advisory listed CVE-2026-65660 as a spoofing vulnerability with a CVSS score of 6.5 and no impact on integrity or availability. The CVE record was later updated, on September 11, to describe it as a remote code execution flaw. Teams that triage by vendor severity labels likely placed it in a normal patch cycle rather than an emergency one.
Which SharePoint versions are affected?
SharePoint Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. The fixed builds, per the Canadian Centre for Cyber Security, are 16.0.5565.1001 for 2016, 16.0.10417.20198 for 2019 and 16.0.19725.20522 for Subscription Edition. SharePoint Online in Microsoft 365 is not listed as affected.
Is CVE-2026-65660 being exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on September 25, 2026, based on evidence of active exploitation, and the Canadian Centre for Cyber Security reports active exploitation as well. Chained with other SharePoint vulnerabilities, it can lead to pre-authentication remote code execution on servers that allow anonymous access.
What is the CISA deadline?
U.S. federal civilian agencies must remediate CVE-2026-65660 by September 28, 2026. The deadline binds federal agencies only, but CISA urges every organization to prioritize vulnerabilities listed in the KEV catalog.
Sources
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (September 25, 2026)
Canadian Centre for Cyber Security — AL26-023: Vulnerability impacting Microsoft SharePoint Server (CVE-2026-65660)
Microsoft Security Response Center — CVE-2026-65660 (vendor advisory)
The Hacker News — SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Security Affairs — U.S. CISA adds Microsoft SharePoint and MikroTik RouterOS flaws to its KEV catalog