CVE-2026-65660
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 25, 2026
- US federal agencies must remediate it by Sep 28, 2026 (BOD 22-01)
- First attack observed 43 days after disclosure
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 25, 2026 Sep 24, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20522 |
Related articles
Warlock Uses On-Premises SharePoint to Deploy Ransomware on at Least 33 Hosts
China-linked Warlock ransomware exploited on-premises SharePoint flaws to breach utilities and governments, deploying ransomware on 33+ hosts via SYSVOL.
NetScaler Intrusions Turn a Gateway Flaw Into Root-Level Network Access
Mandiant links CVE-2026-88772 to NetScaler attacks granting root access, web shells, and internal network tunnels across dozens of orgs.
SharePoint Code-Injection Flaw Opens a Low-Privilege Route to Remote Server Control
CVE-2026-65660 lets low-privilege users run code on SharePoint Server via SafeControls bypass. Learn impact, affected versions and patch steps.
This product uses the NVD API but is not endorsed or certified by the NVD.