SharePoint RCE exploited in the wild (CVE-2026-65660) [PoC]
CVE-2026-65660
CVE-2026-65660: SharePoint code injection lets an authorized attacker run code over the network (CVSS 8.8). CISA KEV listed; apply Microsoft's patch now.
Actively exploited in the wild - CVE-2026-65660 is a high-severity code injection flaw in Microsoft Office SharePoint that allows an authorized attacker to execute arbitrary code over the network. CISA has added it to the Known Exploited Vulnerabilities catalog, so unpatched farms should be treated as compromised until proven otherwise.
Overview
SharePoint accepts and processes input in ways that can be shaped into executable code rather than inert data. CVE-2026-65660 is an improper control of code generation issue: an attacker who already holds a low-privileged, authenticated account can craft requests the server turns into running code. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes a remote, low-complexity attack that needs a valid login but no victim to click anything and no elevated role to start.
Impact
Successful exploitation gives the attacker code execution in the context of the SharePoint application on the server. From there the realistic outcomes are web shell deployment, credential theft from configuration and cache stores, lateral movement into connected Microsoft 365 services, and persistent access that survives a reboot. Because SharePoint commonly sits behind single sign-on and holds sensitive intranet content, a compromised farm can expose documents far beyond the original low-privilege account.
The EPSS score sits at 1.2%, which reflects the narrower authenticated precondition rather than the risk. KEV inclusion means exploitation is confirmed and the clock is running: U.S. federal agencies must remediate on the CISA-mandated timeline, and private organizations should match that urgency.
Remediation and Mitigation
- Apply Microsoft’s security update for the affected SharePoint Server builds immediately. Patch the entire farm, including application and database tiers, then run the SharePoint Configuration Wizard on each server.
- Treat every authenticated account as a potential entry point. Audit for recently created accounts, unusual site collection permissions, and role changes made outside normal change windows.
- Hunt for indicators: unexpected .aspx or compiled binaries in web directories, anomalous w3wp.exe child processes, outbound connections from SharePoint hosts, and new solutions or features deployed without a change ticket.
- If you cannot patch at once, restrict network exposure of the farm, enforce least privilege on all accounts, and enable verbose audit logging on site collections. These are stopgaps, not fixes.
- Rotate service account credentials and any secrets stored in SharePoint configuration after patching if you suspect prior compromise.
For context on the current exploitation wave, see our weekly threat roundup and coverage of the earlier SharePoint RCE CVE-2026-45659 added to CISA KEV.
Security Insight
This is the second SharePoint code execution flaw to reach CISA KEV in a short window, which suggests attackers have settled on the product as a durable initial-access platform rather than opportunistically hitting one bug. The pattern echoes the 2023 SharePoint ToolShell-style intrusions, where authenticated footholds were chained into full farm compromise because patching lagged behind discovery. The recurring lesson is that Microsoft’s on-premises collaboration stack carries internet-facing risk comparable to edge appliances, and defenders who treat it as an internal tool will keep meeting attackers who do not.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| HORKimhab/CVE-2026-65660 CVE-2026-65660 - Draft or TODO | ★ 0 |
Showing 1 of 1 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network....
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Other Microsoft Sharepoint Server Vulnerabilities
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network....
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....