CVE-2026-65660 · High · CISA KEV

CVE-2026-65660: SharePoint Code Injection Exploited In The Wild

Threat Engine Auto-Feed · data current as of 2026-09-25

A code injection vulnerability in Microsoft SharePoint, CVE-2026-65660, allows an authorized attacker to execute code remotely. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. Its EPSS percentile of 67.43% indicates a higher-than-average likelihood of exploitation.

  • CVSS:
  • EPSS percentile: 0.6743
  • Exploitation pressure: 65/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 67th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves 'code injection,' a flaw where an application incorrectly processes user-supplied input, allowing an attacker to insert and execute their own malicious code. In this case, an authorized attacker can inject and run code within the SharePoint environment.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations heavily reliant on Microsoft SharePoint for collaboration and document management
  • Enterprises in Financial Services and Technology sectors, given assessed adversary targeting

Misconfigurations that escalate it

  • Over-privileged user accounts within SharePoint environments
  • Lack of robust network segmentation for SharePoint servers

High-impact scenarios

  • Remote code execution leading to full compromise of SharePoint servers
  • Data exfiltration from sensitive SharePoint document libraries
  • Lateral movement within the network from a compromised SharePoint instance
  • Disruption of critical business operations relying on SharePoint services

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor SharePoint server logs for unusual process execution or unauthorized access attempts.
  • Implement network intrusion detection systems (NIDS) to flag anomalous traffic patterns originating from or directed at SharePoint servers.
  • Regularly audit SharePoint user permissions to identify and revoke any unnecessary elevated privileges.

Contain

  • Isolate affected SharePoint servers from the broader network if compromise is suspected.
  • Temporarily restrict access to SharePoint services for non-essential users.
  • Review and enforce strict access controls for all SharePoint sites and content.

Patch

  • Apply the latest security updates and patches released by Microsoft for SharePoint to address CVE-2026-65660.

Frontier verdict — High

High priority due to active exploitation in the wild (CISA KEV) and significant potential impact on critical collaboration platforms.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.