CISA Flags CVE-2026-65660 SharePoint Code Injection

Executive Summary

CISA has added CVE-2026-65660, a code injection flaw in Microsoft SharePoint, to its Known Exploited Vulnerabilities (KEV) catalog, giving U.S. federal civilian agencies until 2026-09-28 to apply vendor mitigations or discontinue use of the affected product. The KEV entry describes the bug as a network-reachable code injection issue that an authorized attacker can use to execute code.

The listing is the primary signal here: KEV inclusion means CISA has evidence of exploitation in the wild, and the short remediation window — three days from the date of this article — reflects the agency's BOD 26-04 risk-based patching regime. The KEV entry itself does not publish a CVSS score, a named threat actor, or a list of affected SharePoint build numbers, so defenders should treat Microsoft's own advisory as the authoritative source for version coverage and patch availability.

Technical Analysis

According to the CISA KEV entry, CVE-2026-65660 is a code injection vulnerability in Microsoft SharePoint that "could allow an authorized attacker to execute code over a network." Two details in that phrasing matter for defenders:

• "Authorized attacker" — the flaw requires some level of authenticated access to the SharePoint environment. It is not described as an unauthenticated pre-auth RCE. That shifts the threat model toward insider abuse, compromised low-privilege accounts, and post-phishing lateral movement rather than drive-by internet scanning.
• "Execute code over a network" — the injection is reachable remotely, meaning an attacker who already holds a foothold on the network (or valid credentials) can pivot to code execution on the SharePoint host without local access.

CISA's KEV entry does not disclose the injection vector (e.g., a specific API endpoint, web part, or deserialization path), the affected SharePoint versions (on-premises Subscription Edition, 2019, 2016, or SharePoint Online), or whether exploitation is confirmed against on-premises deployments, cloud tenants, or both. The KEV notes direct readers to "apply mitigations in accordance with vendor instructions" and reference BOD 26-04 and CISA's Forensics Triage Requirements, but the entry itself does not embed the Microsoft advisory link in the excerpted text.

Because KEV inclusion is triggered by evidence of exploitation, the practical read is that at least one real-world intrusion has been tied to this flaw. CISA has not published the victim, sector, or campaign details, and no CVSS base score appears in the KEV record. Defenders should not infer a severity rating from the KEV listing alone — KEV means "known exploited," not "critical."

Mitigations & Recommendations

CISA's required action for CVE-2026-65660 is explicit: apply mitigations per the vendor's instructions, in line with BOD 26-04's risk-based update guidance and CISA's Forensics Triage Requirements. Where mitigations are unavailable for a given deployment, the KEV entry directs agencies to discontinue use of the product. The due date for federal civilian agencies is 2026-09-28.

For defenders outside the federal civilian scope, the same logic applies with a shorter decision loop than usual:

• Locate every SharePoint instance in the estate — on-premises Subscription Edition, 2019, and 2016 are the most likely candidates for a code-injection patch; confirm whether SharePoint Online tenants are also in scope by checking Microsoft's advisory directly.
• Treat internet-exposed SharePoint as the priority tier. Even though the flaw requires an authorized attacker, exposed instances widen the pool of credentials an attacker can try to obtain.
• Check Microsoft's advisory for the exact patch or workaround before assuming a configuration change is sufficient. CISA's KEV entry does not itself contain the mitigation steps — it points to the vendor.
• Hunt for post-exploitation behavior on SharePoint hosts: unexpected w3wp.exe child processes, anomalous web-part or solution deployments, and outbound connections from the SharePoint application pool to unfamiliar endpoints.
• Review authentication logs for recently created or modified accounts with elevated SharePoint permissions, since the "authorized attacker" framing implies credential access is part of the kill chain.

Given the 2026-09-28 KEV deadline and the absence of a public CVSS score or IOC set, the highest-value defensive action is confirming patch status against Microsoft's advisory rather than waiting for additional CISA detail.