On September 25, 2026, CISA added CVE-2026-65660, a code injection flaw in Microsoft SharePoint, to its Known Exploited Vulnerabilities (KEV) catalog. CISA’s due date was September 28, 2026, so installing the update comes first. The entry lists ransomware use as “Unknown.” This alert is for organizations that run SharePoint Server on their own servers.
What is affected
CISA’s entry says Microsoft SharePoint “contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.” The NVD record classifies it as improper control of generation of code (CWE-94) and was published on August 11, 2026.
The NVD record’s affected-product data lists these x64 versions as affected:
- SharePoint Enterprise Server 2016: 16.0.0 before 16.0.5565.1001
- SharePoint Server 2019: 16.0.0 before 16.0.10417.20198
- SharePoint Server Subscription Edition: 16.0.0 before 16.0.19725.20522
Only the Subscription Edition build is also bounded in the record’s CPE configuration. For the 2016 and 2019 editions, that section lists the products without a version limit, so use the affected-product data above when you compare builds.
How serious it is
The CVSS 3.1 base score is 8.8 (high): the attack runs over the network, is not complex, needs only a low-privilege account and no action from another user, and rates confidentiality, integrity and availability impact as high. The flaw needs an authorized account, so who holds accounts on the server matters.
What CISA requires
The KEV entry tells organizations to apply mitigations in accordance with vendor instructions, and to follow CISA’s BOD 26-04 guidance and its Forensics Triage Requirements. It also tells stakeholders to evaluate each asset’s internet exposure, and to discontinue use of the product if mitigations are unavailable.
Checklist
- List every SharePoint Server you run and note its edition and version.
- Compare each build number with the affected ranges above. Anything below the listed build is affected.
- Follow Microsoft’s vendor instructions for CVE-2026-65660, which CISA’s entry points to. CISA’s notes list this Microsoft page as the vendor reference.
- Note which servers can be reached from the internet. CISA asks owners to assess that exposure.
- Read CISA’s forensic triage requirements in the BOD 26-04 guidance and decide whether any server needs a closer look for signs of compromise.
- Limit who holds accounts on SharePoint to the people who need them, since the flaw needs an authorized user.
How to check
Find the build number your SharePoint farm reports for each server, write it down next to the edition, and compare it with the three ranges above. After the update is installed, check the build number again and confirm it is at or above the listed build for that edition. Keep the before and after numbers with your change records.
What can wait
The update itself should not wait. Broader cleanup of old sites and permissions can follow once the affected servers are updated.
When to get help
If you cannot tell which build a server runs, or you cannot patch it, our engineers can help. See our cybersecurity services or contact us.