SharePoint CVE-2026-65660 in CISA KEV: Code Injection by an Authenticated Attacker

On September 25, 2026, CISA added CVE-2026-65660 to its KEV catalog: a code injection in Microsoft SharePoint, remotely exploitable by an authenticated attacker. The remediation deadline was September 28 — it has already passed.

NVD hasn't published a score, vector or version list at the time of writing. I'm relying solely on the CISA entry. The affected editions and the updates to apply should be taken from the Microsoft Security Update Guide (MSRC) for this CVE.

What CISA Says

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

Two words carry all the weight: authorized and execute code. You need an account, and that account then lets you run code on the SharePoint server.

"Authenticated" Doesn't Mean "Low Risk"

The reflex is to deprioritise a flaw that requires an account. On SharePoint, that's a mistake, for three reasons.

There are lots of accounts. An enterprise SharePoint is open to every employee, often to contractors and external guests. Each account is a possible starting point, and one phished credential is enough.

The server is a hub. Running code on a SharePoint server means reaching the farm service account, the content databases, the machine keys used to sign state data, and often accounts with broad rights in Active Directory.

SharePoint chains. In July, four SharePoint CVEs entered KEV within three weeks, including an authentication bypass: an "authenticated" flaw becomes unauthenticated as soon as it's combined with another. That's the pattern we described in our analysis of the July wave. I'm not claiming CVE-2026-65660 is part of such a chain: CISA doesn't say so. But it's the scenario not to rule out.

And the KEV listing means exploitation has been observed, not theorised.

Versions

Nothing from NVD at the time of writing. I won't invent a build number. For each server in the farm:

• note the installed build version (Central Administration or SharePoint PowerShell)
• compare it with the fixed build Microsoft lists for CVE-2026-65660 and your edition
• make sure the configuration wizard was run after installing the update: up-to-date binaries with a non-upgraded database leave the farm in an inconsistent state

SharePoint Online is managed by Microsoft; the question applies to on-premises deployments.

Detection

• Unexpected child processes of the SharePoint IIS application pool (w3wp.exe): command shells, PowerShell, network tools
• Recently created files in LAYOUTS directories and site web folders, outside documented solution deployments
• Unusual user account activity: access to admin pages or features the user never touches, just before a server-side anomaly
• Use of the farm service account from a machine other than the SharePoint servers

Mitigation

1. Apply the Microsoft security update that fixes CVE-2026-65660 on every server in the farm, then run the configuration wizard. The CISA deadline has passed: deal with it now.
2. Don't expose on-premises SharePoint directly to the internet. If external access is needed, go through an authenticating reverse proxy or a VPN.
3. Review external and guest access: removing what's no longer used shrinks the pool of possible starting accounts.
4. Check that AMSI integration is enabled if your edition supports it, and that server antivirus is up to date.
5. If compromised: rotate the farm's ASP.NET machine keys and the service account credentials. Patching without rotating keys leaves the attacker with what they've already stolen.

Why Continuous Monitoring of SharePoint Farms Matters

SharePoint keeps coming back to KEV month after month, often with three-day deadlines and no NVD data when it's time to act. The only information that lets you respond in time is the exact build of each server.

With cveo.tech, inventory your SharePoint servers with their versions, and get alerted as soon as a CISA KEV CVE affects them.