Vulnerabilities · Threat Intelligence · Application Security
Microsoft SharePoint flaw lets attackers run code on servers: CISA urges urgent patching
A serious vulnerability in Microsoft SharePoint is being exploited by attackers. CISA has added the flaw (CVE-2026-65660) to its Known Exploited Vulnerabilities list and told organisations to patch immediately.
Ross GrantUpdated 3 min read
The short version
A dangerous bug in Microsoft SharePoint lets attackers run their own code if they have access to the server. US authorities have confirmed real attacks and told organisations to patch urgently. If left unpatched, attackers could take control of affected servers.
By the numbers
- 28 September 2026CISA patching deadline for US federal agenciesCISA
- 8.8CVSS score for the vulnerability (NVD)The Hacker News
- 16SharePoint vulnerabilities in CISA's KEV catalogueSecurityWeek
What happened?
A serious vulnerability in Microsoft SharePoint (CVE-2026-65660) is being exploited by attackers. CISA added the flaw to its Known Exploited Vulnerabilities list on 25 September 2026 and ordered US federal agencies to patch by 28 September. The flaw allows authenticated attackers to run code on affected servers.
What is the SharePoint vulnerability?
A newly exploited flaw in Microsoft SharePoint, tracked as CVE-2026-65660, allows attackers with low-level access to run their own code on affected servers. The US Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue on 25 September 2026, after seeing evidence of real-world attacks. Microsoft released a patch for the flaw in August, but exploitation attempts have increased since technical details were published by security researchers in September.CISA (opens in a new tab)SecurityWeek (opens in a new tab)
How does the attack work?
The vulnerability is a code injection issue. An attacker who is already authorised to use the SharePoint server (even with low privileges) can exploit the flaw to run arbitrary code. This means the attacker could install malware, create backdoors, or move further into the network. The flaw sits in how SharePoint checks certain server-side controls. By abusing how the software handles web-part markup, an attacker can inject extra commands and load dangerous code. Researchers have shown that, in some cases, this flaw can be combined with other weaknesses to allow unauthorised attackers to gain access, but this requires chaining with a separate authentication bypass that was already patched earlier in 2026.The Hacker News (opens in a new tab)
Who is affected and what should they do?
SharePoint Server 2016, 2019, and Subscription Edition are affected. Microsoft initially described the flaw as a less serious spoofing issue, but later confirmed it allows remote code execution (RCE). CISA has set a patching deadline of 28 September 2026 for US federal agencies. All organisations using SharePoint should apply the August 2026 security update as soon as possible. If patching is not possible, CISA recommends taking the affected servers offline or following Microsoft's mitigation advice. CISA also requires agencies to check for signs of compromise before and after patching.CISA (opens in a new tab)
Timeline and response
- August 2026: Microsoft releases a patch for CVE-2026-65660.
- 22 September 2026: Researchers publish full technical details and a working exploit.
- 24–25 September 2026: Threat intelligence firms observe exploitation attempts and webshell deployments.
- 25 September 2026: CISA adds the flaw to its KEV list and mandates urgent patching for federal agencies.
Microsoft and CISA both urge all organisations to prioritise this patch, especially if their SharePoint servers are accessible from the internet.
Practical advice for defenders
Security teams should:
- Apply the latest SharePoint patches immediately.
- Review logs and systems for signs of unauthorised access or webshells.
- Limit access to SharePoint servers and avoid exposing them directly to the internet where possible.
- Follow CISA's forensic triage requirements if compromise is suspected.
What is at stake?
If exploited, attackers could take control of SharePoint servers, steal data, or use the server as a foothold for further attacks. In regulated industries, failure to patch could lead to fines or legal action if customer or sensitive data is exposed. The flaw is now public and being actively targeted, so delays in patching increase risk.
Claimed vs confirmed
- Confirmed
The flaw was initially classified as a spoofing issue by Microsoft, not remote code execution.
Microsoft's advisory and CVE record show the classification changed after further research.
- Confirmed
Exploitation attempts began after technical details were published.
SecurityWeek and threat intelligence platforms observed attacks shortly after public disclosure.
The impact
- Money
- If exploited, organisations could face costs for incident response, recovery, and possible regulatory fines (for example, GDPR fines can reach €20m or 4% of annual turnover).
- Reputation
- A compromise of SharePoint servers could damage trust, especially if sensitive data is leaked or business operations are disrupted.
- Customers
- Customers' data stored in SharePoint could be at risk. Organisations should notify affected users if a breach is confirmed and follow legal requirements for disclosure.
Why it matters
Many organisations use SharePoint to store and share important documents. If attackers exploit this flaw, they could steal data, disrupt business, or launch further attacks. The vulnerability is now public and being actively targeted, making quick patching essential.
How does it work?
The flaw lets an attacker with low-level access to SharePoint inject code by abusing how the server processes certain web-part markup. This bypasses type checks and allows arbitrary .NET classes to be loaded, leading to remote code execution. In some configurations, chaining with other flaws could allow unauthorised attackers to exploit it.
Key points
- CISA confirms active exploitation of a serious SharePoint flaw (CVE-2026-65660).
- The vulnerability allows authenticated attackers to run code on affected servers.
- Microsoft released a patch in August 2026; urgent patching is required.
- Technical details and exploits are now public, increasing risk.
- Security teams should check for compromise and apply updates immediately.
Sources
CISA
Government
The Hacker News
Reference
SecurityWeek
Reference
