What happened
A critical vulnerability has been identified in Microsoft SharePoint, designated as CVE-2026-65660. This flaw involves a code injection vulnerability that could allow an attacker with authorised access to execute malicious code over a network. The vulnerability has been actively exploited in the wild, with threats targeting affected deployments to potentially gain unauthorised control. The underlying weakness is classified as CWE-94, which relates to implementation errors allowing code injection through crafted input.
Exploitation requires the attacker to have some level of authorised access, but once inside, they can leverage this flaw to execute arbitrary code within the context of the SharePoint service. Because of the active exploitation, affected organisations must prioritise responses to reduce risk and prevent further compromise.
Who is affected
Organisations running Microsoft SharePoint are impacted by this vulnerability. The specific versions or configurations are not detailed, but any deployment with vulnerable components face the threat. Due to the active exploitation, all affected environments should be considered at heightened risk until mitigations are successfully applied.
Recommended actions
- Apply mitigations following vendor instructions promptly. Ensure compliance with CISA’s BOD 26-04 guidance focusing on prioritising security updates based on risk.
- Assess internet exposure of each deployment and determine if updates can be implemented. For instances where mitigations are not yet available, consider discontinuing use of the affected service to prevent exploitation.
- Follow applicable BOD 26-04 guidance for cloud services, including monitoring and incident response procedures.
Indicators of compromise
Indicators of compromise have not been explicitly provided at this time.
