Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660)

Catalog analysis: CISA added this entry on September 25, 2026. The entry reflects catalog information retrieved on September 25, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-65660 is a code injection vulnerability (CWE-94) affecting Microsoft SharePoint. This flaw could allow an authorized attacker to execute arbitrary code over a network. Because this vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog as of September 25, 2026, it is recognized as a risk that is being actively leveraged in the wild.

Exposure and applicability

This vulnerability is relevant to U.S. healthcare providers, health plans, and business associates who utilize Microsoft SharePoint for document collaboration, policy management, or the storage of electronic Protected Health Information (ePHI).

The attack vector requires the actor to be an “authorized attacker,” meaning the individual already possesses some level of authenticated access to the environment. For healthcare organizations, this could include compromised staff credentials or malicious insiders. The ability to execute code over a network poses a risk to the confidentiality and integrity of patient data and may impact the operational resilience of clinical workflows dependent on SharePoint.

Remediation priorities

Our analysis suggests that healthcare security leaders prioritize the following actions based on the urgency indicated by CISA:

1. Apply Vendor Mitigations: The primary priority is to implement the updates or mitigations provided by Microsoft. Given the inclusion in the Known Exploited Vulnerabilities catalog, this should be treated as a high-priority event.
2. Review Access Controls: Since the vulnerability requires an authorized attacker, organizations should review and audit user permissions within SharePoint to ensure the principle of least privilege is applied, potentially limiting the number of accounts capable of triggering the flaw.
3. Assess Internet Exposure: Organizations should evaluate whether their SharePoint instances are exposed to the public internet or restricted to internal networks/VPNs, as this affects the overall risk profile.

How to validate remediation

To verify that exposure has been reduced, IT administrators and security teams can employ the following methods:

• Version Verification: Confirm that the installed version of SharePoint matches the patched version specified in Microsoft’s official update guide for CVE-2026-65660.
• Configuration Audit: Review system logs and configuration settings to ensure that vendor-recommended mitigations are active and functioning as intended.

Limits and open questions

While patching reduces the likelihood of exploitation, it does not eliminate all risks. Residual risk remains if an attacker has already established persistence within the network prior to the update.

Several details remain unknown based on current data: it is not confirmed whether this vulnerability is being specifically targeted by ransomware groups, and the exact sequence of the code injection process is not detailed in the public catalog entry. Organizations should continue to monitor for forensic evidence of unauthorized activity as part of their broader risk management strategy.

Source and editorial note

CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability · Source date: September 25, 2026 · Retrieved September 25, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment