Actively Exploited SharePoint Flaw Enables Remote Code Execution
Summary
CVE-2026-65660 enables remote code execution on vulnerable on-premises SharePoint servers. Exploitation attempts followed public PoC release; Microsoft updates address the flaw, and researchers demonstrated a separate chain that can remove the authentication requirement
Key points
- CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities Catalog on September 25, 2026, after reports of attempts to compromise vulnerable systems.
- The flaw affects SharePoint Server 2016, 2019, and Subscription Edition; SharePoint Online is not listed as affected.
- A low-privileged authenticated user with network access can exploit the flaw remotely to execute code on the server, abusing SharePoint's ToolPane and SafeControls processing.
- Researchers demonstrated an in-memory web shell technique that may leave fewer file-based artifacts for defenders to investigate.
- A separate chain combined the flaw with a previously patched authentication bypass; it could enable unauthenticated code execution on deployments allowing anonymous page access that lacked the earlier fix.
- The article advises installing the August 2026 security updates and verifying June 2026 updates, restricting unnecessary access and anonymous page access, and limiting direct internet exposure.
- Recommended monitoring includes unexpected child processes or outbound connections from w3wp.exe, PowerShell or command-shell activity, unusual authentication and administrative activity, and memory-resident web shells.
Article Details
- Vulnerability Types
- SafeControls validation bypass enabling code execution
- Severity
- CVSS 8.8
- Affected Versions
- SharePoint Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable anonymous page access where it is not required.
- Restrict direct internet access to SharePoint services using VPNs, reverse proxies, or access controls.
- Review SharePoint permissions and remove unnecessary user access.