Is CVE-2026-65660 (Microsoft SharePoint Code Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalogue on 25 September 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Any organisation running the affected product should treat remediation as urgent.

How active exploitation changes the urgency

CISA’s KEV listing means this is not just a theoretical SharePoint flaw, it is an actively exploited vulnerability that should be handled as an urgent operational issue. The practical question is no longer whether the bug exists, but whether your SharePoint estate is exposed, reachable, and still capable of being abused before remediation lands.

Because the vulnerability is a code injection issue in a network-reachable product, the first priority is confirming which SharePoint systems are internet-facing, internally reachable by broad user groups, or integrated with sensitive business workflows. For response teams, the relevant unit of work is the full exposed service, not just a single server or site collection.

For response sequencing and exploit-driven triage, use the Zero-Day and Exploited Vulnerabilities Guide to align KEV-driven prioritisation with emergency containment, patching, and post-fix validation.

What exploitation of SharePoint code injection can enable

A code injection flaw in SharePoint can move from a vulnerability record to practical compromise if an attacker can trigger execution in the application context. In a collaboration platform, that often matters more than the initial payload, because the service may already sit close to content, user sessions, document workflows, and connected internal systems.

Even when the direct answer only states that an authorized attacker can execute code over a network, the operational concern is blast radius. A successful exploit may expose sensitive content, enable pivoting to adjacent systems, or create a foothold for follow-on activity inside the enterprise environment.

For a concrete example of why SharePoint exploitation demands careful compromise assessment and key hygiene after patching, see ToolShell SharePoint exploitation 2025, which shows how attackers can retain code execution after a fix if related secrets were already exposed.

What to do when patching cannot happen immediately

If remediation is delayed, the mitigation goal is to reduce exposure quickly without assuming the environment is safe. That usually means tightening access to the application, reducing external reachability, increasing monitoring for suspicious requests and post-exploitation indicators, and preparing for a compromise assessment if the system has been exposed during the active exploitation window.

When the product is business-critical, compensating controls should be treated as temporary risk reduction, not as a substitute for fixing the issue. If SharePoint supports privileged or high-value workflows, the decision threshold for escalation should be low because exploitation can affect both data exposure and internal trust relationships.

For prioritisation discipline across CVEs, KEV entries, and remediation exceptions, the Vulnerability Management Guide is the right companion reference for setting urgency, verifying remediation, and tracking exception handling.

Risk and Threat Considerations

Actively exploited SharePoint flaws create a short window between public awareness and real-world abuse. The main risks are unauthorised code execution, follow-on compromise of the collaboration platform, and loss of confidence that the exposed service is still clean after patching.

Failure mechanism: An attacker reaches the vulnerable SharePoint endpoint, injects code through the flaw, then uses the resulting execution context to persist, move laterally, or harvest data and credentials already reachable from the application.

Impact: Organisations may face data exposure, service compromise, internal pivoting, and remediation overhead that extends beyond patching into containment, hunting, and credential review.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Active exploitation requires rapid, risk-based prioritisation of exposed SharePoint systems.
Recommendation — Prioritise the vulnerable SharePoint service for immediate remediation and exception review.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue is a known exploited vulnerability that requires timely correction and verification.
	RA-5 — Vulnerability Monitoring and Scanning	Confirming exposure and looking for affected hosts is central to KEV response.
Recommendation — Patch the vulnerable SharePoint systems and verify remediation has taken effect. Scan for exposed SharePoint instances and confirm the affected environment scope.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-driven response depends on prioritising actively exploited vulnerabilities and tracking remediation.
Recommendation — Triage the SharePoint CVE as an urgent remediation item and track closure to completion.
OWASP ASVS	V15 — Secure Architecture	Code injection is an application security failure that demands secure handling of execution paths.
Recommendation — Review application execution paths and remove assumptions that allow injected code to run.

Practitioner Guidance

What to prioritise: Start with exposure confirmation, then rank systems by internet reachability, business criticality, and whether they process sensitive content or sit near privileged internal resources. A KEV-listed SharePoint issue should be handled as urgent even if no compromise is yet confirmed.

What to verify: After remediation, validate more than version state. Check for suspicious web activity, unexpected files or scripts, abnormal account use, and signs that the application was touched before the fix. If the server was exposed while the flaw was being exploited in the wild, treat compromise assessment as part of the remediation.

Practitioner takeaway: For KEV-listed application flaws, the real decision is whether you can prove the service was not abused before and during remediation, not just whether the patch is now installed.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org