PatchaPalooza

CVE-2026-65660: Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-65660 is a remote code execution vulnerability in Microsoft SharePoint Server, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. CISA added it to the Known Exploited Vulnerabilities catalog on 25 September 2026, with a remediation deadline of 28 September 2026 for US federal agencies. The EPSS model estimates a 9.85% probability of exploitation activity in the next 30 days, higher than 96% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 5 security updates (KB5002905, KB5002906, KB5002894, KB5002896 and more). It affects 3 products in 1 product family (Microsoft Office).

Key facts

CVE ID
CVE-2026-65660
Severity
High CVSS 8.8
Microsoft severity
Important
Impact
Remote Code Execution
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-94
EPSS
9.85% (percentile 96%)
CISA KEV
Listed , due
Released
Last updated
Patch Tuesday
August 2026 Patch Tuesday
Product families
Microsoft Office

From the August 2026 Patch Tuesday briefing

SharePoint Server Remote Code Execution

CISA KEV deadline: 2026-09-28. This enables an attacker to run code on a SharePoint Server, a high-value target that often sits close to sensitive documents, internal workflows, and authentication paths. A successful compromise can become a launchpad for data theft, tampering with business content, and lateral movement into the broader Windows environment. Although not Critical, this CISA KEV-listed SharePoint Server RCE warrants treatment as top-tier risk. It is CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and maps to CWE-94 (Code Injection). Exploitation requires network access and low privileges, meaning any attacker who can obtain a basic SharePoint account (stolen creds, password spraying, OAuth abuse, or compromised contractor accounts) can potentially achieve server-side code execution without user interaction.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-65660 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

NVD scores it 6.5 (MEDIUM) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?

Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.

I am running SharePoint Server 2016. Do the updates for SharePoint Enterprise Server 2016 also apply to the version I am running?

Yes. The same KB number applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Customers running either version should install the security update to be protected from this vulnerability.

How could an attacker exploit this vulnerability?

An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required.

Affected products (3)

Microsoft Office

ProductSecurity updateTypeFixed buildRestart
Microsoft SharePoint Enterprise Server 2016KB5002905
KB5002906		Security Update
Security Update		16.0.5565.1001
16.0.5565.1001		Maybe
Maybe
Microsoft SharePoint Server 2019KB5002894
KB5002896		Security Update
Security Update		16.0.10417.20198
16.0.10417.20198		Maybe
Maybe
Microsoft SharePoint Server Subscription EditionKB5002893Security Update16.0.19725.20522Maybe

Security updates (5)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added
Federal due date
Ransomware use
Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

VulnCheck KEV

Date added
Ransomware use
Unknown
Independent sources
1

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

NIST NVD data

NVD status
Analyzed
NVD CVSS
6.5 (MEDIUM)
NVD weakness
CWE-94
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
sharepoint serverbefore 16.0.19725.20522
sharepoint server 2016all listed versions
sharepoint server 2019all listed versions

References

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.
1.1Updated Impact in the Security Updates table, CVE Title, and FAQs. This is an informational change only.
1.2As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.

Sources