Zero Radar
← feed
CriticalVulnerabilityCVE-2026-65660updated 26 Oct 2026, 13:16 UTC

Microsoft SharePoint code injection flaw actively exploited

A logged-in user with some access can send specially crafted input that makes SharePoint run code they should not be able to run. Attackers are already using this flaw.

Exploited (CISA KEV, NVD)Official, 3 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 25 Sept 202
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Authorized attackerStarts with valid low-level access
  2. 2Network requestSends crafted input to SharePoint
  3. 3Code injectionSharePoint generates attacker-chosen code
  4. 4Code executionAttacker code runs on the server
  5. ResultAttacker runs code on SharePoint server

What happened

Microsoft Office SharePoint has an improper control of code generation (code injection) weakness that lets an authorized attacker execute code over the network.

Why it is dangerous: An attacker with valid access could take over the SharePoint server and reach the files and data it stores. Organizations running on-premises SharePoint, and any exposed to the internet, are most at risk.

Are you affected?

You are affected if you run Microsoft Office SharePoint with a version covered by the vendor advisory CVE-2026-65660.

What to do

  1. Check the Microsoft update guide for CVE-2026-65660 and identify the affected SharePoint versions in your environment.
  2. Apply the vendor patch or mitigation as soon as possible, following CISA BOD 26-04 prioritization guidance.
  3. Assess which SharePoint servers are reachable from the internet and patch those first.
  4. If mitigations are not available, follow CISA BOD 26-04 cloud guidance or stop using the affected product.
  5. Run CISA's forensics triage steps to check whether the servers were already compromised.

Timeline

  1. 11 Aug 2026, 17:18 UTC
    Publicly disclosed
  2. 25 Sept 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 26 Oct 2026, 13:16 UTC
    NVD reported on it · NVD

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-65660 · GHSA-r94x-x846-rxqx
CVSS
8.8 / 10
EPSS
8.2% chance of exploitation within 30 days
Disclosed
11 Aug 2026, 17:18 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 13:16 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Microsoft SharePoint code injection flaw actively exploited · Zero Radar