Microsoft SharePoint Code Injection Vulnerability
A code injection flaw in Microsoft Office SharePoint lets an authorized attacker execute code over a network. CVSS 8.8 (high), active exploitation confirmed, CISA KEV deadline September 28, 2026.
- Vendor
- Microsoft
- Product
- SharePoint
- CVSS
- 8.8
- EPSS (exploit probability)
- 9.9%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-65660 being exploited?
Yes. CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list and CIRCL's KEV catalog.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 9.9% (scored November 7, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-65660 timeline
- Published to NVD
- Added to CISA KEV+45d
- Added to EU KEV (ENISA)+45d
- Added to CIRCL KEV+46d
- First 0dayNews coverage+47d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint. An authorized attacker with network access can exploit the affected code path to execute code remotely.
Microsoft originally classified the flaw as a spoofing vulnerability, then updated the advisory to code injection as exploitation evidence came in. As of September 25, 2026, Microsoft confirmed “reliable evidence of observed attacks” without disclosing attacker identity, victim count, or what happened after initial access.
CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on September 25, 2026. Federal civilian agencies must remediate by September 28, 2026, under BOD 26-04.
Apply patches per the MSRC advisory for the specific affected SharePoint builds. Internet-facing SharePoint instances are the highest exposure tier. If immediate patching is not possible, tighten authentication controls and monitor for remote code execution activity.
Other Microsoft SharePoint CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-55040 SharePoint Server JWT token authentication bypasswrite-up | [ CRITICAL ] | 9.1 | 69.5% | |
| CVE-2026-50522 SharePoint Server deserialization of untrusted data RCEwrite-up | [ CRITICAL ] | 9.8 | 3.0% | |
| CVE-2026-58644 Microsoft SharePoint deserialization of untrusted data (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 15.9% | |
| CVE-2026-56164 SharePoint Server elevation of privilege — missing authentication for critical functionwrite-up | [ MEDIUM ] | 5.3 | 27.3% | |
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 80.2% | |
| CVE-2026-32201 SharePoint Server spoofing via improper input validationwrite-up | [ MEDIUM ] | 6.5 | 44.0% | |
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.9% |
