CVE-2026-65660 - Microsoft SharePoint Server Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH KEV

Microsoft SharePoint Server Remote Code Execution Vulnerability

Published Aug 11, 2026 ·Due Sep 28, 2026

8.8

HIGH

CVSS 3.1

EPSS 2.10%

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected products

Vendor Microsoft Product Microsoft SharePoint Enterprise Server 2016 Default
unknown
Affected
- ≥ 16.0.0, < 16.0.5565.1001
Vendor Microsoft Product Microsoft SharePoint Server 2019 Default
unknown
Affected
- ≥ 16.0.0, < 16.0.10417.20198
Vendor Microsoft Product Microsoft SharePoint Server Subscription Edition Default
unknown
Affected
- ≥ 16.0.0, < 16.0.19725.20522

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Microsoft SharePoint Enterprise Server 2016	unknown	Affected ≥ 16.0.0, < 16.0.5565.1001
Microsoft	Microsoft SharePoint Server 2019	unknown	Affected ≥ 16.0.0, < 16.0.10417.20198
Microsoft	Microsoft SharePoint Server Subscription Edition	unknown	Affected ≥ 16.0.0, < 16.0.19725.20522

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (4)

https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
third-party-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
vendor-advisorypatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660
government-resource

Link	Providers	Tags
https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/		third-party-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660		vendor-advisorypatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660		government-resource

Change history (32)

Oct 2, 2026, 05:45 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
- SSVC exploitation
  changed from none to active
Sep 30, 2026, 23:48 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
- SSVC exploitation
  changed from active to none
Sep 30, 2026, 01:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
- SSVC exploitation
  changed from none to active
Sep 29, 2026, 23:48 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
- SSVC exploitation
  changed from active to none
Sep 29, 2026, 23:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
- SSVC exploitation
  changed from none to active
Sep 27, 2026, 23:48 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
- SSVC exploitation
  changed from active to none
Sep 27, 2026, 01:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
- SSVC exploitation
  changed from none to active
Sep 26, 2026, 23:48 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
- SSVC exploitation
  changed from active to none
Sep 26, 2026, 01:42 UTC CISA ADP
- SSVC exploitation
  changed from none to active
Sep 26, 2026, 01:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
Sep 25, 2026, 23:48 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
- SSVC exploitation
  changed from active to none
Sep 25, 2026, 23:42 UTC CISA ADP
- SSVC exploitation
  changed from none to active
Sep 25, 2026, 23:42 UTC CISA ADP
- SSVC exploitation
  changed from active to none
Sep 25, 2026, 21:42 UTC CISA ADP
- SSVC exploitation
  changed from none to active
Sep 25, 2026, 21:42 UTC CISA ADP
- SSVC exploitation
  changed from active to none
Sep 25, 2026, 19:42 UTC CISA ADP
- SSVC exploitation
  changed from none to active
Sep 25, 2026, 03:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
Sep 25, 2026, 03:42 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
Sep 25, 2026, 01:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
Sep 24, 2026, 23:48 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
Sep 24, 2026, 23:43 UTC CISA ADP
- SSVC technical impact
  changed from partial to total
Sep 24, 2026, 23:43 UTC CISA ADP
- SSVC technical impact
  changed from total to partial
Sep 24, 2026, 21:42 UTC CISA ADP
- SSVC technical impact
  changed from partial to total

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Aug 11, 2026

Updated Sep 29, 2026

Reserved Jul 22, 2026

Link CVE-2026-65660

CISA Vulnrichment

Updated Sep 25, 2026

NVD

Status Modified

Modified Aug 27, 2026

Link CVE-2026-65660

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Aug 11, 2026

Updated Sep 29, 2026

Exploited since Sep 25, 2026

Link EUVD-2026-56431

GitHub

No data