Canada’s Cyber Centre reported active exploitation of CVE-2026-65660 in Microsoft SharePoint Server on September 24, 2026. The next day, Microsoft said it had reliable evidence of observed attacks; CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-65660 lets an authenticated attacker execute code on a vulnerable server.
The scope matters: the alert concerns on-premises SharePoint Server farms, not SharePoint Online in Microsoft 365. Chaining the flaw with a separate SharePoint vulnerability can enable pre-authentication execution on servers configured to allow anonymous access to certain pages if the required earlier updates are missing.
What CVE-2026-65660 does
Microsoft describes the issue in its security guide, while technical analyses detail an insufficiently controlled code-generation path. The documented consequence is code execution on the vulnerable server in the context available to the attacker.
The flaw does not mean every SharePoint site was compromised. It does require checking versions, exposure, authorised accounts and changes in the farm.
The active-exploitation signal
On September 25, Microsoft added that it had reliable evidence of observed attacks. CISA added CVE-2026-65660 to its KEV catalog the same day. Previdian also described exploitation attempts observed by its sensors; these reports establish activity, but do not give a complete list of targeted organisations or successful compromises.
Published technical details describe a bypass of SharePoint’s SafeControls checks and an in-memory payload. The absence of a new ASPX file therefore does not rule out exploitation: review requests, processes, SharePoint and IIS events, and configuration changes.
Administrator checks
Inventory SharePoint Server 2016, 2019 and Subscription Edition, then check the fixed builds listed by Canada’s Cyber Centre: 16.0.5565.1001 for 2016, 16.0.10417.20198 for 2019, and 16.0.19725.20522 for Subscription Edition. Versions 2016 and 2019 reached end of support on July 15, 2026; plan migration to a supported release. Reduce internet exposure and restrict access to administration interfaces.
Preserve IIS, SharePoint, Windows and authentication logs. Look for unusual requests, unexpected ASPX files, child processes of w3wp.exe, recently created accounts and unusual outbound connections.
After a suspicion
Isolate the affected farm without destroying evidence. Rotate service secrets, administrator credentials and keys that may have been reachable, then review connected systems and sensitive libraries.
Users should treat reset or sharing requests arriving after the alert carefully. A compromised collaboration server can also support targeted phishing even when the exact data accessed is not yet known.
The Soclyde connection
Soclyde does not patch SharePoint or replace an investigation of an on-premises farm. It can help teams prepare a documented access rotation: generating unique secrets and keeping them in local-first encrypted vaults avoids copying them into temporary scripts or tickets. For team handover, see our guide to sharing passwords securely.
That organisation reduces secret copies during response; it does not detect exploitation or guarantee SharePoint integrity.
Key takeaways
CVE-2026-65660 is being exploited against on-premises SharePoint Server. Patch farms, distinguish Server from Online, preserve logs and investigate execution evidence before deciding on broad rotation. Read the secure password generator guide or contact Soclyde.
