CISA Adds SharePoint Code Injection CVE-2026-65660 to KEV, Setting a Sept 28 Federal Patch Deadline
Microsoft initially downgraded the flaw to a 6.5 spoofing issue, then reclassified it as RCE. CISA's deadline passed on September 28, 2026; unpatched instances are now an exposed target.
CVE-2026-65660, a code-injection flaw in on-premises Microsoft SharePoint Server, landed in CISA's Known Exploited Vulnerabilities catalog on September 25, 2026. The flaw allows an authenticated, low-privileged attacker to execute arbitrary code on a running SharePoint instance. CISA's evidence confirmed real in-the-wild exploitation, not just theoretical risk, and the agency set a federal-remediation deadline for September 28, 2026, which has now passed.
How the flaw works
Microsoft's advisory classifies the vulnerability as a code injection flaw (CWE-94) with a CVSS 3.1 score of 8.8 — network-exploitable, low complexity, low privilege required, no user interaction. An attacker who already holds a low-privileged account crafts POST requests carrying malicious form-field values to SharePoint layout pages, bypasses .NET control validation, and reaches attacker-controlled deserialization that can load arbitrary assemblies on the server. Affected versions span SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition.
The classification delay
Microsoft initially rated the flaw at CVSS 6.5 and framed it as a spoofing issue — not a remote-code-execution bug. That assessment held for several weeks before Microsoft reclassified it as RCE in the Microsoft Security Response Center tracking. The downgrade-to-upgrade gap matters: it gave exploiters a window to weaponise the flaw before defenders had a proper severity signal. The fix shipped on August 11, 2026 under KB5002905, and CISA's KEV addition followed on September 25.
Part of a sustained campaign
CVE-2026-65660 is the seventh SharePoint vulnerability added to CISA's KEV catalog in the past six months. Prior entries — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040 — affect the same on-premises SharePoint versions and have drawn sustained exploitation attempts since CISA's July 14, 2026 hardening alert. A six-vulnerability sustained campaign against a single enterprise application is unusual and consistent with deliberate targeting rather than opportunistic scanning.
What to do
- Apply the
KB5002905August 2026 security update on every supported on-premises SharePoint instance, and confirm the June 9, 2026 update that closed the anonymous delivery route is also in place. - Disconnect public-facing end-of-life SharePoint (2013 and earlier) from the internet. If it is not patchable, it is a persistent, unmitigated target.
- Apply CISA's mitigation guidance for supported versions, including avoiding direct public exposure of SharePoint servers to the internet.
- Audit externally-facing SharePoint instances for post-exploitation indicators — unusual injected assemblies, unexpected service accounts, data-exfiltration channels — if a compromise is suspected.
- If you cannot patch quickly, restrict SharePoint access to authenticated internal-network users only and document the risk for FedRAMP and equivalent regulators before your compliance window closes.
What this means for you
If your organisation runs on-premises SharePoint Server, the federal patch deadline has already passed and the flaw is confirmed exploited in the wild. An unpatched instance sitting on the internet is a live target for any actor with a foothold behind your authentication layer. If you cannot patch within days, take the instance offline rather than wait for it to be found.
Sources: CISA: Adds Two Known Exploited Vulnerabilities to Catalog (Sept 25, 2026); CISA: Urges SharePoint Hardening After New Exploitations (July 14, 2026); Shattered.io: SharePoint CVE-2026-65660 CISA KEV Analysis.
Corrections: Report an error at corrections@wireshaman.com.