Microsoft SharePoint Code Injection Vulnerability
A code injection flaw in Microsoft Office SharePoint lets an authorized attacker execute code over a network. CVSS 8.8 (high), active exploitation confirmed, CISA KEV deadline September 28, 2026.
- Vendor
- Microsoft
- Product
- SharePoint
- CVSS
- 8.8
- EPSS (exploit probability)
- 2.1%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint. An authorized attacker with network access can exploit the affected code path to execute code remotely.
Microsoft originally classified the flaw as a spoofing vulnerability, then updated the advisory to code injection as exploitation evidence came in. As of September 25, 2026, Microsoft confirmed “reliable evidence of observed attacks” without disclosing attacker identity, victim count, or what happened after initial access.
CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on September 25, 2026. Federal civilian agencies must remediate by September 28, 2026, under BOD 26-04.
Apply patches per the MSRC advisory for the specific affected SharePoint builds. Internet-facing SharePoint instances are the highest exposure tier. If immediate patching is not possible, tighten authentication controls and monitor for remote code execution activity.
