For: organisations that run Microsoft SharePoint Server on their own servers (Subscription Edition, 2019 or 2016), and the partners who maintain them. SharePoint Online in Microsoft 365 is not listed in the advisory. This page is based on Microsoft's security update guide, NVD and CISA's KEV catalog; it contains no attack steps or exploit code.
Developing: this page will be updated as more is published
- Who is affected
organisations that run Microsoft SharePoint Server on their own servers (Subscription Edition, 2019 or 2016), and the partners who maintain them. SharePoint Online in Microsoft 365 is not listed in the advisory.
- Confirmed so farSee the table ↓
- Affected products and fixed builds
- Login needed
- Attacks in the wild
Listed as possibly affected
- Attempts without a login via anonymous viewing
- Not yet confirmed
- How many servers were attacked or compromised
- The CVE number of the separate issue fixed in June 2026, and whether Microsoft links the two
- What attackers did after running code on servers
- What to do nowSee the steps ↓
- Check the build on every server in the farm
- Install every update package for your version
- Confirm the June 2026 updates are also installed
2 more
- Review anonymous access
- Check servers that were behind on updates
- Where to verify (source)All sources ↓
- Microsoft, Security Update Guide: CVE-2026-65660, Microsoft SharePoint Server Remote Code Execution Vulnerability (August 11, 2026; revision 1.2, September 25)
- Last checked
- As of October 31, 2026 (JST)
Follow-up plans and what we checked
Microsoft's advisory (revision 1.2, September 25) and the KEV entry are public. We checked Microsoft's security update guide, NVD and CISA's KEV feed (version 2026.10.30) on October 31.
What to do today
Check the build on every server in the farm
In SharePoint Central Administration, or with PowerShell on each server, read the installed build and compare it with the fixed build for your version: Subscription Edition 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001. Check every server in the farm, including search and application servers.
Install every update package for your version
Subscription Edition: KB5002893. SharePoint Server 2019: KB5002894 and KB5002896. SharePoint Enterprise Server 2016: KB5002905 and KB5002906. Microsoft's FAQ says to apply all updates offered for the installed software. After installing, run the SharePoint Products Configuration Wizard (or PSConfig) on each server so the update is completed.
Confirm the June 2026 updates are also installed
A security firm reports that attack attempts combined this flaw with a separate issue that a security research team says was fixed on June 9, 2026. Make sure the June 2026 SharePoint updates are in place, not only August's.
Review anonymous access
The attempts the security firm describes depend on sites that allow anonymous viewing. List which web applications and sites have anonymous access turned on, and turn it off where it is not needed. Keep SharePoint off the internet unless it has to be public, and put it behind a gateway that requires sign-in where possible.
Check servers that were behind on updates
KEV marks this CVE for CISA's forensic triage requirements. In general terms (our suggestion): look for new .aspx or .dll files in SharePoint's web folders that your team did not deploy, unexpected processes started by the IIS worker process, and unusual POST requests in the IIS logs from addresses you do not recognise. If you find anything you cannot explain, isolate the server, involve your incident response team, and rotate the credentials and keys the server holds before reconnecting it.
What was disclosed
- Product
- Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Enterprise Server 2016 (on premises)
- Type
- Code injection (CWE-94)
- Authentication
- Required: low-level access. No user interaction (Microsoft)
- Severity
- CVSS v3.1 8.8; Microsoft rating Important
- Fixed builds
- Subscription Edition 16.0.19725.20522 (KB5002893); 2019 16.0.10417.20198 (KB5002894, KB5002896); 2016 16.0.5565.1001 (KB5002905, KB5002906)
- Released
- August 11, 2026 (monthly security updates)
- Exploitation
- "Reliable evidence of observed attacks" as of September 25, 2026 (Microsoft)
- KEV
- Added September 25, 2026; due September 28. Marked for CISA's forensic triage requirements
1. Check builds
Every server in the farm
2. Install all packages
August KBs, and June's updates too
3. Review and check
Anonymous access; signs of compromise
Timeline
June 9, 2026
A security research team reports that a separate SharePoint issue allowing anonymous delivery of requests was fixed on this date (no CVE number identified in its write-up).August 11
Microsoft publishes CVE-2026-65660 and security updates, first describing it as a spoofing flaw.August 27
Microsoft changes the title, impact and FAQ to remote code execution (revision 1.1, described as informational).September 24
A security firm reports attack attempts on a honeypot that combine this flaw with the separate anonymous delivery issue.September 25
Microsoft adds that it has reliable evidence of observed attacks (revision 1.2). CISA adds the CVE to the KEV catalog with a due date of September 28.October 31
No further revision of Microsoft's advisory.
What is known and not known
| Item | What the sources say | Status |
|---|---|---|
| Affected products and fixed builds | Three on-premises versions; August 11 updates | Confirmed (Microsoft) |
| Login needed | Low-level access, no user interaction | Confirmed (Microsoft) |
| Attacks in the wild | Reliable evidence of observed attacks (September 25) | Exploitation confirmed (Microsoft) |
| Attempts without a login via anonymous viewing | Attempts seen on a honeypot, combined with a separate issue | Possible |
| CVE number of the June issue | Not identified in the sources we checked | Not stated |
| Number of servers compromised | Not published | Not stated |
| SharePoint Online | Not listed in Microsoft's advisory | Not stated |
Microsoft's advisory data still showed "Exploited: No" in its summary field on October 31, while the revision note of September 25 says attacks were observed. The revision note is the later statement, and CISA lists the CVE as exploited.
Why the first label mattered
When the update came out on August 11, the advisory called this a spoofing flaw. It became remote code execution only on August 27, in a revision Microsoft marked as informational; Microsoft did not treat revision 1.1 as needing a notification. Teams that sorted the August updates by impact may have scheduled it later than other fixes.
The lesson for any SharePoint farm is to install each month's SharePoint updates as a set, rather than choosing by the label on each CVE. Labels can change after release, and a flaw that needs a login can be combined with another that removes that need.
Sources
Checked on October 31, 2026 (JST).
- Microsoft, Security Update Guide: CVE-2026-65660, Microsoft SharePoint Server Remote Code Execution Vulnerability (August 11, 2026; revision 1.2, September 25) — msrc.microsoft.com
- NVD, CVE-2026-65660 — nvd.nist.gov
- CISA, Known Exploited Vulnerabilities Catalog (added September 25, 2026) — cisa.gov
- Security firm's report of attack attempts (September 24, 2026; updated September 25) — blog.previdian.com
Update history
2026-10-31: First version, based on Microsoft's security update guide, NVD, CISA's KEV catalog and a security firm's report.
Read next
- Exploited the same period: Exploited edge device vulnerabilities, mid-October 2026
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Checking for compromise: How to check whether your server was compromised
- Response steps: Vulnerability remediation playbook
- Terms: What is remote code execution (RCE)? / What is CVSS?