CISA has added CVE-2026-65660, a high-severity code-injection vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Microsoft originally disclosed and patched the flaw on August 11, 2026, but the September 25 KEV addition changes the risk profile considerably because defenders are no longer dealing with a vulnerability that attackers might exploit. They are dealing with one that attackers already are exploiting.

The flaw affects on-premises editions of Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Microsoft describes the issue as improper control over the generation of code, or code injection, which allows an authenticated attacker with low privileges to execute code remotely over the network. The vulnerability carries a CVSS score of 8.8, requires low privileges, does not require user interaction, and can have high impact on confidentiality, integrity, and availability.

The fact that authentication is required should not lead organizations to dismiss the severity. A low-privileged SharePoint account may be obtainable through credential theft, password reuse, phishing, compromised session tokens, or existing footholds elsewhere in the organization. Once an attacker already possesses a basic SharePoint identity, CVE-2026-65660 can potentially turn limited access into code execution on the server itself.

That is a major escalation because the security boundary between “ordinary SharePoint user” and “code running on the SharePoint server” is enormous.

SharePoint frequently contains some of the most valuable internal information in an enterprise, including documents, project material, contracts, financial records, HR information, customer data, technical documentation, credentials embedded in files, and internal operational procedures. Gaining code execution on the server can therefore expose far more than a single user account or document library.

The risk also extends beyond the data stored directly in SharePoint. SharePoint servers commonly integrate with Active Directory, databases, search services, identity infrastructure, and other internal Microsoft systems. A compromised SharePoint server can therefore become a foothold for deeper reconnaissance or lateral movement if network segmentation and service-account privileges are weak.

This is a code-execution vulnerability, not simply a document-access flaw

The distinction is important.

An access-control vulnerability might allow an attacker to read information they should not see.

CVE-2026-65660 potentially allows the attacker to execute code within the context of the SharePoint environment.

That can enable much broader activity, including modification of files, deployment of web shells, credential harvesting, reconnaissance, or attempts to move deeper into the network depending on the configuration and privileges available.

This is why CISA classifies the technical impact as total in its current SSVC assessment.

Active exploitation was observed before the KEV addition

Independent exploitation telemetry reported by Previdian shows attempts against CVE-2026-65660 on September 24, one day before CISA formally added it to KEV. Their sensor network recorded 16 exploitation attempts from two attacker IP addresses against one sensor during the observation period.

The absolute number is relatively small and should not be interpreted as evidence of widespread mass exploitation. However, the importance lies in confirmation that working exploitation is occurring against Internet-facing infrastructure.

CISA’s subsequent KEV addition provides the stronger signal: the vulnerability now meets the agency’s threshold for evidence of active exploitation.

The attack is not necessarily fully unauthenticated

This point deserves emphasis because vulnerability headlines can easily become more dramatic than the underlying technical conditions.

Microsoft’s CVSS vector explicitly indicates:

PR:L

meaning low privileges are required.

An attacker therefore needs some form of authenticated access before exploiting CVE-2026-65660.

That does not make the issue unimportant.

In many real intrusions, low-privileged credentials are already available through initial-access phishing, password spraying, credential-stealing malware, session theft, or previous compromises.

The vulnerability can then become a privilege and capability multiplier.

The attacker moves from:

valid low-privileged account

to:

code execution on the SharePoint server

That is precisely the kind of transition attackers value.

SharePoint remains a particularly attractive target

SharePoint has repeatedly drawn attacker attention because it combines broad enterprise deployment, valuable data, and close integration with identity and internal systems.

Organizations often expose SharePoint externally for collaboration, remote access, supplier portals, or hybrid work.

That gives attackers a reachable application with enormous potential value behind it.

Even where SharePoint is not Internet-facing, compromise of another endpoint or stolen VPN credentials may still place an attacker in a position to exploit it internally.

The security value of patching therefore extends beyond Internet exposure alone.

The flaw was patched more than a month ago

One of the more important lessons from this KEV addition is the timeline.

Microsoft released the fix on August 11, 2026.

CISA added the flaw to KEV on September 25, 2026.

That means organizations had approximately six weeks to deploy the security update before confirmed exploitation drove the issue into the KEV catalog.

This is another example of the familiar patch-gap problem.

Once an update becomes public, attackers can study what changed, identify vulnerable code paths, develop proof-of-concept techniques, and begin targeting systems that remain on older builds.

The longer organizations delay deployment, the larger the opportunity becomes.

Administrators should verify build numbers, not merely Windows Update status

Affected SharePoint editions have specific fixed build levels.

According to the CVE record, vulnerable versions are those below:

SharePoint Enterprise Server 2016: 16.0.5565.1001

SharePoint Server 2019: 16.0.10417.20198

SharePoint Server Subscription Edition: 16.0.19725.20522

Administrators should verify the actual SharePoint build running on each farm rather than relying on assumptions that normal Windows patching automatically placed SharePoint at a safe level.

SharePoint patching has historically required deliberate maintenance and verification, particularly in multi-server farms.

A server reporting that operating-system updates are current does not necessarily establish that the SharePoint security update has been applied successfully across every node.

CISA gives federal agencies only three days

CISA added CVE-2026-65660 on September 25 with a remediation deadline of September 28, 2026.

That three-day window is significant.

CISA’s newer risk-based BOD framework uses KEV status, exposure, and potential impact to prioritize remediation. A deadline measured in days rather than weeks indicates that the vulnerability should be treated as an immediate operational security issue.

Organizations outside the U.S. federal government are not bound by CISA’s deadline, but the underlying threat intelligence applies just as well to them.

Attackers do not politely check whether a SharePoint server belongs to a federal agency before trying an exploit.

Patching should be followed by compromise assessment

Because exploitation is active, affected organizations should avoid treating patch installation as the end of the incident.

The correct process is:

patch → verify → hunt

Security teams should inspect IIS and SharePoint logs for suspicious activity occurring before remediation and pay particular attention to unusual requests against ToolPane-related functionality, unexpected authenticated sessions, abnormal request patterns, and activity from unfamiliar IP addresses.

SharePoint application and Windows event logs should also be reviewed for suspicious process creation or code-execution activity.

Look for unusual child processes from SharePoint and IIS

If exploitation leads to server-side execution, one useful hunting technique is to examine processes spawned by IIS worker processes or SharePoint components.

Unexpected execution of tools such as:

cmd.exe

powershell.exe

pwsh.exe

cscript.exe

wscript.exe

or other utilities from IIS or SharePoint-related parent processes should attract immediate attention.

Not every such event proves exploitation, because administrative tooling can sometimes create legitimate process chains, but they are valuable signals when combined with suspicious web requests or unusual account activity.

Search for new or modified files

Security teams should also inspect SharePoint and IIS directories for newly created or recently modified files.

Web shells and post-exploitation scripts are common ways for attackers to retain access after exploiting web applications.

Defenders should look for unexpected:

  • .aspx files;
  • scripts;
  • binaries;
  • configuration modifications;
  • scheduled tasks;
  • services;
  • persistence mechanisms.

Recently created files that do not correspond with normal SharePoint deployment or update activity warrant investigation.

Review authentication activity around the exploitation window

Because CVE-2026-65660 requires an authenticated attacker, identity telemetry can provide useful context.

Organizations should examine:

  • unusual SharePoint logins;
  • successful authentication from unexpected IP ranges;
  • impossible travel;
  • newly observed user agents;
  • low-privileged accounts exhibiting unusual behavior;
  • service accounts being used interactively;
  • sudden access to administrative or system-level functions.

If the account used for exploitation can be identified, defenders should assume its credentials or session tokens may already have been compromised independently of the SharePoint flaw.

Resetting or revoking that access may therefore be necessary even after patching.

Service-account privileges deserve scrutiny

SharePoint environments often rely on privileged service accounts.

If an attacker achieves code execution within a process running under an over-privileged identity, the blast radius can extend dramatically.

Organizations should therefore review whether SharePoint application pools and services possess more Active Directory, SQL Server, or network privileges than genuinely necessary.

Least privilege may not prevent initial exploitation, but it can significantly limit what an attacker can achieve afterward.

Internet-facing SharePoint should receive priority

Any vulnerable SharePoint Server directly reachable from the Internet should be remediated first.

Security teams should inventory externally accessible SharePoint instances, including forgotten staging systems, legacy collaboration portals, temporary environments, and disaster-recovery installations.

An organization may diligently patch its primary SharePoint farm while leaving an older test deployment publicly reachable.

Attackers scanning the Internet do not care which server appears on the official asset spreadsheet.

SharePoint Online is different

CVE-2026-65660 specifically concerns affected on-premises SharePoint Server products.

Organizations using Microsoft 365 SharePoint Online should not assume that the presence of “SharePoint” in the CVE automatically means their SaaS tenant requires the same patching action.

Microsoft controls the underlying platform for SharePoint Online.

The primary remediation burden is therefore on organizations operating their own SharePoint Server installations.

This distinction is important for avoiding unnecessary alarm while still prioritizing the systems that genuinely require intervention.

Do not prioritize purely by CVSS

The vulnerability carries a CVSS score of 8.8 rather than the more attention-grabbing 9.8 or 10.0 ratings associated with some other recent enterprise flaws.

Yet it is now actively exploited.

That illustrates why modern vulnerability management should not treat CVSS as the sole prioritization mechanism.

The more useful calculation is:

severity + exploitability + Internet exposure + asset value + business impact

A CVSS 8.8 vulnerability under active exploitation against an externally accessible SharePoint farm containing sensitive corporate information may represent a substantially more urgent threat than a theoretical CVSS 10 vulnerability on an isolated system.

KEV status supplies exactly that missing exploitation context.

SharePoint compromise can have long-term consequences

A successful SharePoint intrusion can provide information that remains useful to attackers long after the vulnerability itself is patched.

Stolen internal documents may reveal network diagrams, employee names, supplier relationships, project information, credentials, software inventories, or incident-response procedures.

Attackers can use that information later for phishing, social engineering, lateral movement, extortion, or attacks against third parties.

This means compromise assessment should consider not just whether the attacker left malware behind but also what information they may have accessed before remediation.

The broader cybersecurity lesson

CVE-2026-65660 demonstrates a familiar but important progression:

vulnerability disclosed → patch released → organizations delay → attackers develop exploitation → active attacks observed → CISA adds flaw to KEV

The technical vulnerability matters.

But the operational lesson matters just as much.

Microsoft provided a fix on August 11.

By September 25, CISA had evidence sufficient to classify the vulnerability as actively exploited.

The organizations most exposed today are therefore not waiting for a vendor patch.

They are waiting to install one that has existed for weeks.

The appropriate response is straightforward:

identify affected SharePoint farms → verify build numbers → apply Microsoft updates → investigate the pre-patch exposure period → review authentication and process telemetry → rotate compromised credentials where necessary.

CISA’s KEV designation means this has moved beyond theoretical vulnerability management.

The attackers have entered the equation.

At that point, the question should no longer be simply:

“Are we vulnerable?”

It should be:

“How long were we vulnerable while attackers already knew how to exploit it?”

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . P

Source: CISA Adds One Known Exploited Vulnerability to Catalog via CISA Advisories — published 25 Sep 2026.