CVE-2026-65660 is a code injection vulnerability in Microsoft SharePoint. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 September 2026, which means attackers have used it in real attacks. Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
What the vulnerability means in SharePoint
A code injection flaw in Microsoft SharePoint means an attacker can supply input that the application handles as executable code rather than data. In a collaboration platform, that is especially dangerous because SharePoint often sits close to documents, internal workflows, and trusted application logic.
For this CVE, the key security problem is not just that code can run, but that it can run over the network. That makes the issue a remote attack path into a high-value enterprise platform, which is why exposed SharePoint services are routinely prioritised in vulnerability management and exploit-response programs. See the NIST National Vulnerability Database and the CVE Program for authoritative record details.
Why code injection is dangerous here
Code injection becomes severe when the vulnerable product is internet-facing or reachable through widely trusted business processes. In SharePoint, that can turn a seemingly ordinary request into execution inside the application context, which may expose content, configuration, credentials, or adjacent systems that trust the SharePoint server.
The most important practical concern is that exploitation can convert a web application issue into broader compromise. Once an attacker runs code inside the SharePoint environment, they may be able to pivot into internal resources, modify content, or establish persistence. For background on how web application flaws escalate into broader exploitation patterns, the OWASP Top 10 remains a useful reference point for understanding injection-driven risk.
How organisations assess exposure and reduce blast radius
Exposure checks should start with an inventory of every SharePoint instance, including internet-facing deployments, internet-reachable management paths, and any older environments that may have fallen out of patch visibility. Security teams should then compare those assets against the vendor advisory and the KEV record, because exploitability in the field matters more than abstract severity alone.
When patching cannot happen immediately, compensating controls should focus on reducing reachability and limiting what a successful request can touch. The practical aim is to shrink the blast radius around the SharePoint server, not to assume the platform is safe while it remains unpatched.
For a structured approach to prioritisation, the Vulnerability Management Guide is relevant because it ties asset scope, KEV status, verification, and remediation workflow together.
Detection, response, and post-exploitation review
Because this is a remotely reachable code injection issue, defenders should treat successful exploitation as a likely foothold event, not a one-off application bug. Review SharePoint logs, web server logs, and surrounding telemetry for unusual requests, abnormal child processes, suspicious file writes, or signs that the server began making unexpected outbound connections.
After patching, organisations should still assess whether the compromise persisted beyond the vulnerable request. A code injection path can be used to plant web shells, alter application logic, or harvest secrets that remain valid after the vulnerability is fixed. The ToolShell SharePoint exploitation 2025 article shows why SharePoint incidents often require more than a simple patch, and the ASP.NET machine key attacks 2025 article illustrates how key material can keep post-patch compromise alive.
Risk and Threat Considerations
CVE-2026-65660 is especially concerning because it combines network reachability with executable server-side impact in a widely used enterprise content platform. That creates a direct route from initial access to system-level abuse, content tampering, or follow-on compromise if the SharePoint host is trusted by other internal services.
Failure mechanism: An attacker sends crafted input that SharePoint processes as code, then uses the resulting execution context to run commands, modify content, or stage persistence on the server.
Impact: The compromise can expose internal data, enable lateral movement, and force identity, session, or secret review if the server handled privileged application material during exploitation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V1 — Encoding and Sanitization | Code injection is directly prevented by strict handling of untrusted input. |
| Recommendation — Validate and encode untrusted SharePoint inputs before they can influence executable logic. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The issue hinges on unsafe input reaching executable application paths. |
| SI-16 — Memory Protection | Code injection can abuse unsafe execution paths that memory protection helps constrain. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on reviewing logs and identifying abnormal activity. | |
| Recommendation — Enforce input validation on SharePoint-facing interfaces and block unsafe parameters. Apply platform protections that reduce arbitrary code execution opportunities. Review SharePoint and host logs for signs of exploitation and persistence. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Exploit status and KEV inclusion make rapid vulnerability prioritisation essential. |
| Recommendation — Prioritise and remediate the SharePoint CVE using exposure-aware vulnerability management. | ||
Practitioner Guidance
Why practitioners should care: SharePoint vulnerabilities often sit at the intersection of business-critical collaboration and high-trust application hosting, so a single exposed instance can become an enterprise-wide access point. Prioritise this CVE wherever the affected server is internet-reachable or supports sensitive workflows.
What to watch for: Treat unusual web requests, unexpected process launches, and post-exploitation file changes as escalation signals. If there is evidence of code execution, review adjacent authentication material, service secrets, and privileged sessions even after remediation.
Practitioner takeaway: Use the vendor advisory and the CISA KEV catalogue for authoritative patch timing and version details, then verify whether exploitation already occurred before declaring the system clean.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org