ZeroDayAlert

CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

Microsoft SharePoint Added to KEV 2026-09-25 Federal due 2026-09-28 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Microsoft SharePoint installations are vulnerable to a code injection flaw that permits an authenticated attacker to execute arbitrary code over the network. The record does not specify which SharePoint versions, deployment models (on-premises, online, or hybrid), or authentication scopes are affected; you should treat all SharePoint deployments as potentially in scope until Microsoft's guidance clarifies the affected versions.

How to check whether this touches you

  • Inventory your SharePoint estates: list all on-premises farms, cloud tenancies (Microsoft 365 subscriptions), and hybrid configurations with their deployment dates and current patch levels.
  • Establish reachability: confirm whether your SharePoint front-end servers accept connections from the internet or from networks outside your direct administrative control; on-premises farms behind authentication gateways or air-gapped are lower-risk.
  • Cross-reference your running versions against Microsoft's published vulnerability scope; note that version strings alone do not confirm whether a patch has been backported, so corroborate with patch-level metadata from Windows Update or your patch-management system.
  • Determine user scope: check whether the vulnerability requires specific permission levels (site collection admin, farm admin, or ordinary user authentication) in Microsoft's advisory, as this shapes the practical exposure of your estate.

What to do

  1. Retrieve Microsoft's official security advisory for CVE-2026-65660 and CISA's BOD 26-04 guidance; confirm the affected versions, patch availability, and any interim mitigations before you begin remediation planning.
  2. If you run on-premises SharePoint, prioritise patching systems reachable from untrusted networks; if you run SharePoint Online (within Microsoft 365), confirm whether Microsoft has already deployed fixes to your tenancy and whether any configuration change is required.
  3. Until patches are applied, restrict network access to SharePoint front-end servers to named, authenticated accounts only; review conditional access policies, firewall rules, and reverse-proxy configurations to reduce the attack surface for code injection attempts.
  4. Enable detailed logging for SharePoint code execution and authentication events; configure alerts for failed authentication followed by code-execution attempts, and ensure logs are retained for at least 90 days.
  5. Escalate to your change-control board if patching will require downtime; if you cannot patch within the federal remediation window of 2026-09-28 and mitigations are unavailable, escalate to business leadership with a discontinuation plan in accordance with BOD 26-04.

If you find you were exposed

Exploitation of an authenticated code-injection vulnerability typically occurs weeks or months before public disclosure; examine authentication logs, process-execution logs, and SharePoint audit events for the 60 days prior to the advisory date for signs of unusual code execution, lateral movement, or data exfiltration by authenticated users. If your log retention does not extend that far, document the gap and cross-reference it with endpoint detection and response (EDR) systems, backups, or security information and event management (SIEM) archives that may preserve older events; ransomware campaigns often establish persistence or staging areas, so search for newly created scheduled tasks, service installations, or staged tools on affected servers.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-65660 is being exploited. It cannot tell you whether SharePoint is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →