Actively Exploited SharePoint Server Code Injection Flaw Puts On Premises Deployments At Risk
A code injection vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-65660, is being exploited in the wild against on-premises deployments. The flaw is classified as Improper Control of Generation of Code, or CWE-94, and allows an authenticated attacker to execute arbitrary code on a vulnerable SharePoint server. Microsoft published its security advisory for the issue on 11 August 2026, and the Canadian Centre for Cyber Security followed with alert AL26-023 on 24 September 2026 after observing active exploitation. Three product families are in scope: SharePoint Enterprise Server 2016 before build 16.0.5565.1001, SharePoint Server 2019 before build 16.0.10417.20198, and SharePoint Server Subscription Edition before build 16.0.19725.20522. SharePoint Online and other Microsoft 365 hosted workloads are not named in the advisory; the exposure sits with organisations still running SharePoint on their own infrastructure.
The mechanism is a code injection weakness reached through normal SharePoint request handling, where attacker-supplied content is processed in a way that results in code being generated and run on the server. On its own the flaw requires authentication, which narrows the population of attackers who can use it directly. The more serious scenario described in the advisory is chaining: combined with other previously disclosed SharePoint vulnerabilities, CVE-2026-65660 can be used to reach pre-authentication remote code execution on servers configured to permit anonymous access. That makes patch completeness the deciding factor, because an environment that is behind on earlier SharePoint security updates effectively hands an attacker the missing link in the chain. Detection guidance issued alongside the alert points to the behaviours associated with this activity, including deserialization attacks, web shell deployment, unauthorised access to IIS machine keys, unexpected web part modifications, and privilege escalation following suspicious authenticated access. Microsoft has not published full exploitation mechanics, and public reporting characterises the observed activity as two-stage exploitation attempts rather than a single request payload.
SharePoint is rarely a peripheral system. It typically holds document libraries, intranet content, business process data and integration credentials, and it is commonly joined to Active Directory and reachable from a large internal user population — and in many deployments from the internet as well. Code execution on a SharePoint front end therefore tends to translate quickly into credential access and lateral movement rather than staying contained to the application. Theft of IIS machine keys is particularly consequential, because those keys can allow an attacker to forge authentication material and retain access even after an initial foothold is removed. The exploitation status is not speculative: CVE-2026-65660 was added to the CISA Known Exploited Vulnerabilities catalogue on 25 September 2026, confirming observed real-world attacks, while FIRST's EPSS model currently places the probability of exploitation activity in the next 30 days at 1.2 percent. That low modelled figure is consistent with targeted rather than indiscriminate use, a pattern that historically changes once technical detail circulates more widely. Compounding the problem, SharePoint Enterprise Server 2016 and SharePoint Server 2019 both reached end of life on 15 July 2026, so organisations running those editions are exposed on a platform with no ongoing support lifecycle behind it.
Attack Surface
Content Management System, Web Application, Server OS
Tactics
Initial Access, Execution, Persistence, Credential Access, Privilege Escalation
Techniques
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1505.003 – Server Software Component: Web Shell
- T1078 – Valid Accounts
- T1552 – Unsecured Credentials
SuperPRO's Threat Countermeasures Procedures
- Upgrade affected on-premises SharePoint farms to the fixed builds named in the Microsoft advisory for CVE-2026-65660: SharePoint Enterprise Server 2016 to 16.0.5565.1001, SharePoint Server 2019 to 16.0.10417.20198, and SharePoint Server Subscription Edition to 16.0.19725.20522.
- Verify that all prior SharePoint security updates have been installed before relying on this patch alone, because CVE-2026-65660 reaches pre-authentication remote code execution only when chained with earlier unpatched SharePoint vulnerabilities on farms permitting anonymous access.
- Plan migration off SharePoint Enterprise Server 2016 and SharePoint Server 2019 to SharePoint Server Subscription Edition or SharePoint Online, as both 2016 and 2019 reached end of life on 15 July 2026 and will receive no further security servicing.
- Enable Antimalware Scan Interface (AMSI) integration for every SharePoint web application and set AMSI Request Body Scan Mode to Full Mode where operationally supported, then confirm Microsoft Defender is active on all SharePoint and IIS servers in the farm.
- Remove direct internet exposure of SharePoint servers where the business case allows, and restrict SharePoint Central Administration and other management endpoints to a dedicated administrative network segment rather than general user VLANs.
- Audit SharePoint and Active Directory for unused or inactive farm and service accounts, remove them, and enforce multi-factor authentication for farm administrators and other privileged SharePoint users, since the flaw requires authentication in its unchained form.
- Alert in the SIEM on SharePoint and IIS telemetry for web shell file writes under the LAYOUTS and wwwroot directories, w3wp.exe spawning cmd.exe or powershell.exe, unexpected web part or farm configuration changes, and any read or export of IIS machine keys.
