2026-10-31
SharePoint Server CVE-2026-65660: code execution by a logged-in user, exploited (install the August 2026 updates)
CVE-2026-65660 is a code injection flaw in on-premises Microsoft SharePoint Server (Subscription Edition, 2019 and Enterprise 2016). Per Microsoft, an authenticated attacker with low-level access can send a specially crafted request to execute code on the server, with no user interaction. It is rated CVSS 8.8. The fix shipped in the August 11, 2026 security updates. Microsoft first published it as a spoofing flaw and changed it to remote code execution on August 27. On September 25 Microsoft added that it had reliable evidence of observed attacks, and CISA added it to the KEV catalog the same day with a due date of September 28. A security firm reported on September 24 that attack attempts on a honeypot combined this flaw with a separate issue, reported as fixed in June 2026, that lets the request arrive without a login on sites that allow anonymous viewing. Our conclusion: if you run SharePoint Server, confirm every server is at or above the fixed build, make sure the June 2026 updates are also installed, review anonymous access, and check servers that were behind on updates for signs of compromise.