Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft SharePoint Server 2016, 2019, and Subscription Edition.
Authorized attackers can execute arbitrary code over the network, leading to full server compromise.
Apply official Microsoft security updates immediately and monitor for unauthorized web shell activity.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Immediate Patching: Deploy the latest Cumulative Updates (CU) provided by the Microsoft Security Response Center (MSRC).
- Privilege Reduction: Ensure the SharePoint service account operates under the principle of least privilege to limit the impact of a potential breach.
- Monitoring & Detection: Implement WAF rules to inspect and block suspicious traffic targeting SharePoint API endpoints and monitor for the creation of unexpected files in the
inetpub\wwwrootdirectory.
# Example: Check for suspicious .aspx files in SharePoint directories
find /inetpub/wwwroot/wss/VirtualDirectories -name "*.aspx" -mtime -1Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
CVE-2026-65660 is a Code Injection vulnerability (CWE-94) resulting from improper control of code generation within Microsoft SharePoint. An authenticated attacker with even low-level privileges can trigger the execution of arbitrary code by injecting malicious payloads into server-side processes. This vulnerability is currently listed in the CISA KEV catalog, confirming active exploitation in the wild. With an EPSS score of 0.94, the probability of encountering an exploitation attempt is extremely high, making it a critical threat to enterprise collaboration environments.
Official Vendor Advisories & References
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.