> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-65660 Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-65660-microsoft-sharepoint-microsoft-sharepoint-code-injection-vulnerability/ - Published: 2026-09-25T16:21:55.000Z - Updated: 2026-09-25T16:21:55.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-65660 ## 1\. Executive summary CVE-2026-65660 is a code injection flaw in Microsoft SharePoint, rated CVSS 8.8 HIGH (CWE-94), and CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-09-25 with a remediation due date of 2026-09-28\. The vulnerability allows an authorized attacker to execute code over a network, which places it in the same SharePoint exploitation cluster as five other KEV-listed SharePoint flaws patched and exploited across 2026 (CVE-2026-45659, CVE-2026-58644, CVE-2026-50522, CVE-2026-56164, CVE-2026-55040). For EMEA financial services clients running on-premises SharePoint Server, the exposure is direct: SharePoint is typically internet-facing for partner and remote-worker access, and a three-day federal remediation window signals CISA has evidence of active exploitation. EPSS is 1%, so exploitation is targeted rather than mass-scanned, but the KEV listing and the short due date outweigh the low EPSS for prioritisation. No ransomware campaign use is recorded. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17 | CVE-2026-65660 is in CISA KEV with a 2026-09-28 due date, indicating active exploitation of a product in the client's ICT estate | The ICT-related incident management process must cover detection, containment and root-cause handling for this exploitation path, not just the patch ticket | | DORA Art. 19 | Active exploitation of an internet-facing SharePoint instance is a candidate major ICT-related incident if it meets the classification thresholds set under Art. 18 | If a SharePoint host is confirmed compromised, the reporting clock to the competent authority starts; the three-day KEV window is not the reporting deadline | | NIS2 Art. 23 | Same trigger: confirmed exploitation of an internet-facing service is a reportable incident for essential and important entities | Early-warning notification obligations apply once exploitation is confirmed, independent of whether the patch has been applied | DORA Art. 18 is the classification gate for Art. 19 and is named here only as the mechanism that determines whether Art. 19 is triggered; the operative obligation is Art. 19\. No other article in the reference is engaged by this item on the facts available. ## 3\. Technical analysis & attack chain The source material for CVE-2026-65660 is thin. NVD records the flaw as a code injection vulnerability (CWE-94) in Microsoft SharePoint that allows an authorized attacker to execute code over a network. No affected version range, no patch identifier, no exploitation mechanism, no proof-of-concept and no post-exploitation detail are present in the primary item or the related sources. The following chain is what the sources support; steps beyond step 2 are inference from the CWE class and the surrounding SharePoint KEV cluster, and are marked as such. 1. An attacker with an authenticated session on a SharePoint instance (the NVD text specifies an authorized attacker) reaches the vulnerable code path over the network. 2. Code injection (CWE-94) allows attacker-supplied input to be evaluated as code in the SharePoint process context, giving code execution on the SharePoint server. 3. Inference, not source-confirmed: because the flaw requires an authorized session, initial access likely comes from a compromised or low-privilege SharePoint account, a guest or partner account, or credentials obtained through the weak-authentication and missing-authentication flaws in the same KEV cluster (CVE-2026-55040, CVE-2026-56164). Treat this as a hypothesis to test during triage, not a confirmed vector. 4. Inference, not source-confirmed: code execution in the SharePoint worker process (w3wp.exe) typically yields the SharePoint service account's privileges, which on many deployments is a domain account with broad access to content databases and the configuration database. This is the standard SharePoint RCE impact profile, not a fact stated in the sources for this CVE. The related sources establish that this is not an isolated flaw. CISA has listed six SharePoint vulnerabilities in KEV during 2026, five of them before this one, with due dates running from 2026-07-04 (CVE-2026-45659) through 2026-08-21 (CVE-2026-55040). SecurityWeek reported that threat actors were exploiting CVE-2026-45659, a deserialization RCE, after it was patched. The pattern across the cluster is deserialization of untrusted data (CVE-2026-45659, CVE-2026-58644, CVE-2026-50522), missing authentication for a critical function (CVE-2026-56164), weak authentication (CVE-2026-55040), and now code injection (CVE-2026-65660). An adversary with a foothold on a SharePoint estate has had a rolling supply of exploitable flaws to move through during 2026. Discrepancy note: the primary item classifies CVE-2026-65660 as CWE-94 code injection, while the majority of the related SharePoint KEV entries are CWE-502 deserialization of untrusted data. Both classifications can describe the same underlying flaw class in SharePoint, and the verified reference data records CWE-94 for this CVE. Use CWE-94 for this item. Attribution: no actor is named in any source for CVE-2026-65660, and no MITRE ATT&CK profile is present in the verified reference data. Attribution is unconfirmed. Do not attribute exploitation to a named group on the basis of this advisory. ## 4\. Mitigation & containment P1 (within 24 hours) - Identify every internet-facing and internal SharePoint Server instance in the estate, including staging, DR and departmental deployments that are often missed. CISA's required action is to evaluate each asset's internet exposure and apply mitigations per vendor instructions. - Apply the Microsoft patch for CVE-2026-65660\. The source does not name the KB or build number; obtain it from Microsoft's September 2026 SharePoint security update advisory. Do not wait for the KB to be confirmed before starting the exposure inventory. - Where a patch is not yet deployable, take the affected instance off the internet or place it behind an authenticated reverse proxy with MFA. CISA's guidance permits discontinuing use of the product if mitigations are unavailable. - Hunt for post-exploitation activity on any SharePoint host that has been internet-facing since the patch was published. Look for w3wp.exe spawning child processes (cmd.exe, powershell.exe, net.exe, whoami.exe), new .aspx or .ashx files in SharePoint layout directories, and outbound connections from the SharePoint server to unfamiliar hosts. - Rotate credentials for SharePoint service accounts and the farm account on any host with confirmed or suspected compromise. SharePoint service accounts frequently hold domain-level rights. P2 (within 72 hours) - Review SharePoint authentication logs for anomalous sign-ins, particularly from partner or guest accounts, and for use of the weak-authentication and missing-authentication flaws in the same cluster (CVE-2026-55040, CVE-2026-56164). Those flaws are already past their KEV due dates and may have been used to obtain the authorized session this CVE requires. - Confirm that the other five KEV-listed SharePoint CVEs in the related sources are patched. Their due dates have all passed; if any remain unpatched, they are the more likely initial-access path. - Restrict SharePoint administrative endpoints (Central Administration, the SharePoint Management Shell, the User Profile Service application) to management VLANs or jump hosts. P3 (within 7 days) - Add the detection rules in §6 to EDR and SIEM. - Review third-party and partner access to SharePoint. DORA Art. 28 and Art. 30 apply if a third-party provider operates or has privileged access to the SharePoint estate; confirm the contract requires the provider to notify you of exploitation within a window that meets your Art. 19 reporting obligations. - Tabletop the Art. 19 reporting path for a SharePoint compromise so the 24-hour early-warning clock is not discovered during a live incident. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The primary item and all related sources are vulnerability records and a news summary; none publishes hashes, domains, IP addresses, file paths or command lines. Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- | | Authenticated SharePoint session used to reach a code-execution path | SharePoint ULS logs, IIS logs, Microsoft 365 Defender for Identity | Low; inferred from the CWE-94 class and the "authorized attacker" wording in NVD, not from a published IOC | | w3wp.exe spawning a command interpreter or scripting host | EDR process telemetry on SharePoint servers | Low; standard SharePoint RCE post-exploitation pattern, not confirmed for this CVE | | New or modified .aspx/.ashx files in SharePoint layout or bin directories | File integrity monitoring on SharePoint servers | Low; inferred, not source-confirmed | | Outbound network connections from the SharePoint server to unfamiliar external hosts | Firewall, netflow, EDR network telemetry | Low; inferred, not source-confirmed | These behaviours are hypotheses for triage, not confirmed indicators. Treat any hit as a lead to investigate, not as proof of exploitation of CVE-2026-65660. ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task names, file paths, registry keys or hard-coded values specific to CVE-2026-65660\. The only artefacts available are the CVE identifier, the product name and the CWE class, none of which are threat artefacts. A rule built on those would detect reporting about the vulnerability, not exploitation of it. The behavioural indicators in §5 are too generic to encode as a Sigma rule without generating false positives across every SharePoint deployment. If Microsoft publishes exploitation telemetry or a proof-of-concept, re-issue this advisory with detection content. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-65660](https://nvd.nist.gov/vuln/detail/CVE-2026-65660?ref=f4n6.co.uk) | 8.8 High | ⚠ KEV 2026-09-25 | 1% | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execu… | ## 7\. Sources - NVD, CVE-2026-65660 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-65660, published 2026-09-24 - CISA Known Exploited Vulnerabilities, CVE-2026-45659 (Microsoft SharePoint Server deserialization of untrusted data), https://nvd.nist.gov/vuln/detail/CVE-2026-45659 - CISA Known Exploited Vulnerabilities, CVE-2026-58644 (Microsoft SharePoint deserialization of untrusted data), https://nvd.nist.gov/vuln/detail/CVE-2026-58644 - SecurityWeek, CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability, https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/ - CISA Known Exploited Vulnerabilities, CVE-2026-50522 (Microsoft SharePoint deserialization of untrusted data), https://nvd.nist.gov/vuln/detail/CVE-2026-50522 - CISA Known Exploited Vulnerabilities, CVE-2026-56164 (Microsoft SharePoint Server missing authentication for critical function), https://nvd.nist.gov/vuln/detail/CVE-2026-56164 - CISA Known Exploited Vulnerabilities, CVE-2026-55040 (Microsoft SharePoint weak authentication), https://nvd.nist.gov/vuln/detail/CVE-2026-55040 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-65660 as high priority for EMEA financial services clients running on-premises SharePoint Server, on the strength of the CVSS 8.8 HIGH rating, the CISA KEV listing dated 2026-09-25 and the three-day federal remediation window, which is the shortest in the SharePoint cluster this year. The 1% EPSS score means exploitation is targeted rather than opportunistic, so clients with no internet-facing SharePoint and no partner access can treat this as P2 rather than P1\. The absence of a named actor, of any published IOC and of a confirmed exploitation mechanism is a real gap: we cannot tell clients what post-exploitation activity to hunt for beyond the generic SharePoint RCE pattern, and we will not invent it. Our next steps are to obtain the Microsoft KB and affected build range for CVE-2026-65660, to check whether Microsoft or CISA has published exploitation telemetry, and to re-issue this advisory with detection content and confirmed indicators if either becomes available. Clients who cannot confirm their SharePoint patch level by 2026-09-28 should contact their Adverse Trace analyst. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-65660?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*