CVE-2026-65660: Microsoft SharePoint Server Code Injection RCE (KEV)

CVE-2026-65660 is a code-injection flaw in Microsoft SharePoint Server (2016, 2019 and Subscription Edition) that lets an attacker with low-level authenticated access send a crafted request and execute code on the server, and CISA added it to the KEV catalog after observing active exploitation roughly six weeks after the August 2026 patch shipped.

CVE-2026-65660 is an improper control of generation of code (CWE-94, "code injection") vulnerability in Microsoft Office SharePoint. NVD's description states it "allows an authorized attacker to execute code over a network" (NVD). Microsoft's own advisory clarifies the access bar: "An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required." (Microsoft MSRC CVRF, August 2026).

NVD lists this CVE with status "Analyzed" and a CVSS v3.1 base score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Microsoft's CVRF entry for August 2026 carries the identical base score and vector, with a temporal score of 7.7 reflecting an "Unproven" exploit maturity rating at the time of release (NVD; Microsoft MSRC CVRF, August 2026).

Microsoft's August 2026 security update (CVRF ID 2026-Aug) lists three affected products and their fixes: SharePoint Enterprise Server 2016 fixed at build 16.0.5565.1001 via KB5002905/KB5002906; SharePoint Server 2019 fixed at build 16.0.10417.20198 via KB5002894/KB5002896; and SharePoint Server Subscription Edition fixed at build 16.0.19725.20522 via KB5002893 (Microsoft MSRC CVRF, August 2026).

CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-25, with a required-action due date of 2026-09-28 (CISA KEV). Security researcher Previdian published a third-party (not Microsoft-confirmed) account describing a two-stage exploitation chain it says it observed around 12:00 UTC on 2026-09-24 against anonymously-accessible SharePoint pages, combining this flaw with a separate, earlier-patched issue; that account is cited here as independent research, not as a vendor statement (Previdian blog).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.08189 (94.841th percentile) (FIRST EPSS).

Organizations running any of the three affected SharePoint builds should apply the relevant August 2026 cumulative update immediately and review SharePoint access logs for the anomalous "DisplayMode=Edit" request pattern described by third-party researchers, given the documented KEV exploitation.

• Code-injection vulnerability (CWE-94) in Microsoft Office SharePoint lets an authenticated attacker with low-level access execute code on the server via a crafted request, no user interaction required. — NVD
• CVSS v3.1 base score 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, matching between NVD and Microsoft's own CVRF entry. — Microsoft MSRC CVRF, August 2026
• Affected: SharePoint Enterprise Server 2016 (fixed 16.0.5565.1001, KB5002905/KB5002906), SharePoint Server 2019 (fixed 16.0.10417.20198, KB5002894/KB5002896), SharePoint Server Subscription Edition (fixed 16.0.19725.20522, KB5002893). — Microsoft MSRC CVRF, August 2026
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-25, due date 2026-09-28. — CISA KEV
• EPSS score is 0.08189 (94.841th percentile) as of 2026-10-27. — FIRST EPSS