SharePoint often holds an organization's most valuable information: contracts, financial records, employee files, policies, project documents, customer information, operational procedures, and management reports.
On September 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-65660 to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The flaw affects several on-premises editions of Microsoft SharePoint Server and can allow an authenticated attacker to execute code on the server.
Microsoft released fixes in August 2026, but active attacks change the urgency. Organizations must verify the correct update and determine whether a vulnerable server was compromised before it was fixed.
If you operate SharePoint Server on your own infrastructure or through a hosting provider, verify the exact version immediately, install all current security updates, restrict exposure, and investigate the period when the server may have been vulnerable.
What is CVE-2026-65660?
CVE-2026-65660 is a code-injection vulnerability in Microsoft SharePoint Server. Microsoft describes it as improper control over the generation of code. In plain language, SharePoint may process a specially crafted request in a way that allows malicious code to run on the server.
Microsoft rates the vulnerability High severity with a CVSS score of 8.8. The documented attack requires authenticated access, but only low-level access may be sufficient and no additional victim action is required.
Attackers regularly obtain valid credentials through phishing, password reuse, malware, third-party compromise, and forgotten accounts. The Canadian Centre for Cyber Security warns that, when chained with other SharePoint vulnerabilities, pre-authentication remote code execution may be possible on servers allowing anonymous access. Missing earlier updates creates greater risk.
Which SharePoint products are affected?
| Product | Affected builds | Minimum fixed build identified |
|---|---|---|
| SharePoint Enterprise Server 2016 | Before 16.0.5565.1001 | 16.0.5565.1001 |
| SharePoint Server 2019 | Before 16.0.10417.20198 | 16.0.10417.20198 |
| SharePoint Server Subscription Edition | Before 16.0.19725.20522 | 16.0.19725.20522 |
Install the latest applicable cumulative security update rather than targeting only the minimum fixed build. SharePoint updates are cumulative and the latest applicable update includes earlier security fixes.
The affected products are server editions operated on-premises or by a hosting provider—not Microsoft-hosted SharePoint Online included in Microsoft 365 plans. A business using only a normal companyname.sharepoint.com environment generally does not administer underlying servers or install server patches. Still, inventory hybrid, legacy, vendor-hosted, and historical systems before concluding that no SharePoint Server exists.
SharePoint Server 2016 and 2019 create an additional concern
SharePoint Server 2016 and 2019 reached end of support in July 2026. Applying the available update addresses this vulnerability, but continuing to operate an unsupported server creates strategic risk. Future vulnerabilities, compatibility problems, and reliability issues may not receive ordinary vendor fixes.
- Is the server patched against the known vulnerability?
- Was it compromised before the patch was installed?
- What is the approved plan and deadline for moving to a supported platform?
Who should be concerned?
- Organizations operating SharePoint Server 2016, 2019, or Subscription Edition
- Businesses hosting SharePoint on office, data-center, cloud, or provider infrastructure
- Hybrid environments connected to Microsoft 365
- Intranets, document portals, workflow systems, records repositories, and external collaboration sites
- Legacy servers retained for custom applications or historical workflows
- Organizations that acquired another company without fully inventorying its systems
- Businesses relying on an IT provider without written patch and investigation evidence
Why installing the patch may not be enough
A patch closes a known vulnerability. It does not reveal what happened before installation. A compromise assessment may need to determine whether an attacker used a stolen account, executed code, changed permissions, created administrators, installed a web shell, accessed SharePoint content or databases, stole service credentials or IIS machine keys, moved to Active Directory or Microsoft 365, disabled monitoring, altered logs, or created another way to return.
The absence of an antivirus alert is not proof that the server is clean. Investigation should combine SharePoint, IIS, Windows, identity, endpoint-security, firewall, proxy, and authentication evidence.
An eight-step response plan
1. Identify every SharePoint environment
Create a verified inventory of server names and addresses, SharePoint editions and builds, Windows Server versions, hosting locations, public URLs, authentication methods, anonymous-access settings, owners, providers, databases, service accounts, integrations, backups, endpoint protection, and logging. Include test, development, disaster-recovery, staging, old, and vendor-managed systems.
2. Verify the exact build and update status
Request evidence of the exact installed SharePoint build and applicable Microsoft update. Record the previously installed build, update applied, installation time, current build on every farm server, configuration completion, errors, and post-update testing. “Windows updates are automatic” is not sufficient evidence.
3. Reduce unnecessary exposure
Determine whether public access is required, whether access can be limited through an approved proxy or VPN, whether management interfaces are externally reachable, whether firewall rules are too broad, whether anonymous access is still needed, and whether former vendors or employees retain access. Exposure reduction complements patching and investigation; it does not replace them.
4. Preserve evidence before destructive changes
When compromise is suspected, preserve SharePoint ULS and IIS logs, Windows events, endpoint telemetry, AMSI and Defender detections, identity logs, network-security records, administrative changes, file history, scheduled tasks, services, connections, suitable snapshots, backups, and configuration exports. Copy evidence through an approved process to a trusted location.
5. Investigate exploitation and persistence
Review unusual administrative activity, suspicious authenticated access, unexpected web-part or configuration changes, access to IIS machine keys, deserialization activity, web shells, malicious processes, privilege escalation, and unusual requests. Determine whether accounts were misused, files changed, secrets accessed, permissions modified, external connections made, or attackers moved to other systems.
6. Review identities and privileged access
Examine dormant accounts, departed employees, former vendors, shared administrators, service accounts with interactive sign-in, excessive privileges, MFA exceptions, reused passwords, recent accounts or group memberships, and unusual resets. Use separate, controlled administrator identities wherever supported.
7. Harden and monitor the supported environment
Enable appropriate AMSI integration and Full Mode request-body scanning where feasible. Use EDR, centralized protected logging, web-shell and child-process alerts, regular scanning, network segmentation, restricted service accounts, protected tested backups, emergency patch procedures, account reviews, and after-hours monitoring.
8. Decide whether to restore, rebuild, or migrate
Patching may be enough only when reliable evidence supports no compromise and the server remains supported. Rebuild when code execution, persistence, credential exposure, critical modification, missing logs, or an untrustworthy baseline prevents confidence. Prioritize migration for unsupported or fragile environments; validate that any restored backup predates compromise.
If telemetry is insufficient, document that uncertainty. “We found nothing” and “we did not have the evidence needed to check” are different conclusions.
Business-continuity considerations
SharePoint may support document access, approvals, forms, policies, customer portals, emergency procedures, or daily workflows. Emergency isolation or rebuilding can interrupt operations.
- Identify departments and processes that depend on SharePoint.
- Maintain approved offline copies of essential documents and contact lists.
- Define temporary methods for approvals and forms.
- Plan how external users will be notified.
- Name who can authorize isolation, restoration, or migration.
- Set acceptable downtime and data-loss limits.
- Test backup restoration and validation.
- Prevent employees from emailing sensitive files as an improvised workaround.
In Southwest Florida, the same plan should work during hurricane preparation, evacuation, power interruption, internet failure, or loss of access to the main office.
How AI can help
Approved AI-assisted security and IT tools can help qualified personnel inventory SharePoint servers, compare builds with guidance, summarize SharePoint, IIS, Windows, and identity logs, identify unusual authentication and process activity, compare files with a trusted baseline, build timelines, correlate events, identify monitoring gaps, group alerts, draft management updates, summarize migration dependencies, and prioritize systems by exposure and business impact.
SharePoint content, credentials, logs, customer information, medical data, legal records, and incident evidence should not be uploaded to an unapproved public AI service. The organization must understand retention, training, access, geography, and audit controls.
Where human judgment is required
Qualified people remain responsible for confirming whether a server is affected; approving downtime; preserving evidence; validating indicators and AI findings; deciding whether to patch, isolate, rebuild, restore, or migrate; coordinating credential rotation; assessing legal, contractual, insurance, and regulatory duties; determining whether data was accessed; communicating with stakeholders; and accepting remaining business risk.
An unusual process may indicate an attack, an approved customization, a backup tool, or a maintenance task. Context and accountable review matter.
Questions to ask your IT or hosting provider
1Do we operate SharePoint Server anywhere, including test, legacy, hosted, or hybrid environments?
2What exact edition and build is installed on every server in each farm?
3Was CVE-2026-65660 fixed, and on what date and time?
4Can you provide update and configuration-completion evidence?
5Was the server internet-accessible while vulnerable?
6Is anonymous access enabled anywhere?
7Were SharePoint, IIS, Windows, identity, endpoint, and firewall logs reviewed for compromise?
8What exposure period was examined?
9Were web shells, suspicious processes, configuration changes, and access to machine keys checked?
10Are logs stored centrally and retained long enough to investigate?
11Which endpoint-security and AMSI protections are active on the server?
12Are privileged SharePoint accounts protected with MFA and separate administrator identities?
13When was the last successful SharePoint recovery test?
14If we use SharePoint 2016 or 2019, what is the migration plan and approved deadline?
15If compromise is found, who coordinates legal counsel, cyber insurance, and incident response?
A provider should supply current configuration and investigation evidence—not only a verbal assurance that patching is automatic.
How Managed Intelligence Advisors can help
Managed Intelligence Advisors helps organizations connect technical vulnerability response with business risk, vendor accountability, recovery readiness, and long-term technology planning.
- Identify on-premises, hosted, legacy, and hybrid SharePoint environments
- Verify editions, builds, update status, and internet exposure
- Coordinate evidence requests with IT and hosting providers
- Review patching, configuration, identity, firewall, and endpoint records
- Coordinate compromise assessment and escalation
- Assess MFA, least privilege, AMSI, EDR, logging, and segmentation
- Evaluate backup integrity and restoration readiness
- Build a practical SharePoint outage and recovery plan
- Map business workflows and critical documents
- Develop a migration roadmap for unsupported SharePoint editions
- Compare supported on-premises, cloud, and hybrid options
- Use AI-assisted analysis with qualified human validation
The objective is not merely to install one update. It is to determine whether the business was exposed, whether the server and connected identities remain trustworthy, whether essential information can be recovered, and whether the organization has a supportable path forward.
Frequently asked questions
What is CVE-2026-65660?
CVE-2026-65660 is a high-severity code-injection vulnerability in Microsoft SharePoint Server. It can allow an authenticated attacker with low-level access to send a specially crafted request and execute code on the server.
Is the SharePoint vulnerability being exploited?
Yes. CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities Catalog on September 25, 2026, based on evidence of active exploitation. Government cyber authorities recommend prompt patching and compromise review.
Does CVE-2026-65660 affect SharePoint Online in Microsoft 365?
The affected-product lists identify on-premises SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. They do not list the Microsoft-hosted SharePoint Online service. Businesses should still verify that no legacy, hybrid, or provider-hosted SharePoint Server remains in use.
Which SharePoint Server versions need attention?
Authorities identify SharePoint Enterprise Server 2016 builds before 16.0.5565.1001, SharePoint Server 2019 builds before 16.0.10417.20198, and SharePoint Server Subscription Edition builds before 16.0.19725.20522 as affected. Organizations should install the latest applicable cumulative security update.
Is patching SharePoint enough?
Not always. Patching closes the vulnerability, but it does not determine whether an attacker exploited the server before the update. Organizations should review relevant SharePoint, IIS, Windows, identity, endpoint, and network evidence for the exposure period.
Why are SharePoint Server 2016 and 2019 a larger concern?
Both editions reached end of support in July 2026. Applying the available fix is urgent, but organizations should also create a funded migration plan to a supported platform because future ordinary security support cannot be assumed.
How can AI help with a SharePoint investigation?
Approved AI-assisted tools can help summarize logs, identify unusual access and processes, correlate events, build timelines, and prioritize systems. Qualified people must validate the results, protect sensitive evidence, and approve response decisions.
How can Managed Intelligence Advisors help?
Managed Intelligence Advisors can identify SharePoint Server exposure, verify remediation evidence, coordinate compromise review, assess identities and recovery readiness, hold providers accountable, and develop a migration roadmap for unsupported environments.
Sources
- CISA: Adds Two Known Exploited Vulnerabilities to Catalog, September 25, 2026
- CISA Known Exploited Vulnerabilities Catalog
- Microsoft Security Response Center: CVE-2026-65660
- Microsoft Learn: SharePoint Server update history
- Microsoft Support: SharePoint Server 2019 August 2026 security update
- Canadian Centre for Cyber Security: AL26-023
- NHS England Digital: Exploitation of CVE-2026-65660
- Microsoft Lifecycle: SharePoint Server 2016
- Microsoft Lifecycle: SharePoint Server 2019