What happened
A code injection vulnerability has been identified in Microsoft SharePoint, designated as CVE-2026-65660. Exploitation of this vulnerability could allow an authorised attacker to execute malicious code over a network. The flaw is actively exploited in the wild, with confirmed cases of exploitation, and is associated with a high severity rating from the vendor, scoring 8.8 on the CVSS base metric. The vulnerability affects multiple versions of Microsoft SharePoint, including Microsoft SharePoint Enterprise Server 2016 (x64-based Systems) versions prior to 16.0.5565.1001, Microsoft SharePoint Server 2019 (x64-based Systems) versions prior to 16.0.10417.20198, and Microsoft SharePoint Server Subscription Edition (x64-based Systems) versions prior to 16.0.19725.20522. The core affected component is the SharePoint software itself, and the weakness is classified under CWE-94, related to code injection through malicious input handling. Microsoft has released a fix for this vulnerability, and assets running affected versions should be updated accordingly. The exploitation path involves the attacker leveraging the vulnerability through network access, allowing code injection without requiring user interaction. The specifics of the attack vector highlight the importance of prompt patch application.
Who is affected
The vulnerability impacts organisations deploying affected Microsoft SharePoint versions. Any deployment of Microsoft SharePoint Enterprise Server 2016 (prior to version 16.0.5565.1001), Server 2019 (prior to 16.0.10417.20198), or Subscription Edition (prior to 16.0.19725.20522) is susceptible. Due to active exploitation, the threat is significant for these environments, particularly where network access to the SharePoint server is possible. Mitigation of the risk depends on timely application of available patches, as the flaw potentially allows malicious code execution without user interaction.
Recommended actions
- Apply the available security update from the vendor to address the vulnerability.
- Review network controls to restrict access to SharePoint services to trusted sources.
