Microsoft SharePoint CVE-2026-65660 Exploited – What You Need to Know

What is CVE-2026-65660?

CVE-2026-65660 is a remote code execution vulnerability discovered in Microsoft SharePoint Server. The flaw resides in the way SharePoint processes specially crafted HTTP requests that target the Web Services component. An attacker who can send a malicious request to a vulnerable SharePoint instance may execute arbitrary code with system privileges, potentially taking full control of the server.

Technical details

The vulnerability is classified as a critical issue with a CVSS score of 9.8. It exploits an input validation error in the SearchService API, allowing stack memory corruption. Successful exploitation results in the attacker gaining a system level shell on the host. Microsoft has assigned the identifier CVE-2026-65660 and published an advisory that includes a detailed description of the affected components.

For a full technical breakdown, see the NIST National Vulnerability Database entry and the MITRE CVE record.

How the vulnerability is being exploited

Within weeks of the public disclosure, threat actors began incorporating CVE-2026-65660 into active campaigns. Observations from multiple security vendors indicate a pattern of exploitation that includes:

• Delivery of malicious payloads via compromised SharePoint sites.
• Use of the vulnerability to bypass network segmentation and move laterally.
• Deployment of ransomware families that leverage the system shell to encrypt files.

Attackers typically start with a reconnaissance phase, scanning public IP ranges for exposed SharePoint services. Once a vulnerable instance is identified, a crafted request is sent to the SearchService endpoint, triggering the code execution path.

Impact on organizations

Because SharePoint is often deployed in intranet environments that host sensitive documents, the fallout from a successful exploit can be severe. Potential consequences include:

1. Unauthorized access to confidential files and intellectual property.
2. Installation of backdoors that persist beyond initial remediation.
3. Disruption of business operations due to ransomware encryption.
4. Compliance violations for industries that must protect regulated data.

Large enterprises that rely on SharePoint for collaboration are especially at risk, as the breach surface can extend to thousands of users.

Response from Microsoft and U.S. agencies

Microsoft released a security update that addresses CVE-2026-65660 on September 10, 2026. The patch modifies the request handling logic in the affected Web Services module and adds additional input validation checks.

The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Agencies are required to apply the patch by September 28, 2026. The official CISA notice can be read on the Known Exploited Vulnerabilities catalog. Microsoft’s detailed advisory is available through the Microsoft Security Response Center.