An authorized attacker has a code-execution route into Microsoft SharePoint Server through CVE-2026-65660, a flaw CISA placed on its exploited-vulnerabilities list on September 25. The federal remediation date was September 28. Operators of SharePoint Enterprise Server 2016, Server 2019 and Server Subscription Edition have three different affected build ranges to check.
CISA calls the flaw code injection that “could allow an authorized attacker to execute code over a network.” A compromised or misused account with access to an affected server is therefore a reason to look beyond the user’s ordinary SharePoint permissions.
An authorized account reaches server code
The Microsoft-authored CVE record classifies the defect as CWE-94, improper control of code generation. Its severity vector specifies a network attack with low privileges and no user interaction: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Code running in the SharePoint process can reach information and services available to that process, even when the attacker started with a low-privilege account.
Map which accounts can reach each SharePoint installation, including accounts still enabled after their business need ended. Restrict unnecessary server access while the affected installation is updated. Keep that access review separate from the software fix: an account still authorized to use SharePoint may meet the exploit’s starting condition.
Three SharePoint editions have separate thresholds
Microsoft’s affected-version data in the CVE record gives an edition-specific upper bound for each vulnerable range. A server on a build below its corresponding threshold falls in the affected range:
| Installed edition | Affected builds below |
|---|---|
| SharePoint Enterprise Server 2016 | 16.0.5565.1001 |
| SharePoint Server 2019 | 16.0.10417.20198 |
| SharePoint Server Subscription Edition | 16.0.19725.20522 |
Those cutoffs come from the Microsoft CVE record’s exclusive end of each affected range. Compare the installed build against the row for that edition, then apply the applicable Microsoft security update and verify the resulting installed build. The NVD entry repeats the Microsoft-provided edition ranges and records CISA’s September 25 addition.
Compare builds and preserve incident evidence
Inventory the three on-premises editions and their installed builds; prioritize any system below its row’s cutoff, especially one reachable by broadly assigned accounts. Remove access that is no longer needed, deploy the vendor’s applicable mitigation or update, and record the post-update build for each server. A build at or above its edition’s threshold passes this affected-range comparison.
CISA’s required action also directs stakeholders to assess each asset’s internet exposure and calls for forensic triage. Federal operators should follow its BOD 26-04 patching and triage guidance; for cloud services, CISA directs applicable cloud guidance or discontinuing use where mitigation is unavailable. For a server with signs of suspicious authorized access, preserve relevant server and account evidence before remediation and follow your incident process. A build comparison answers the patch question; investigate suspicious activity as a separate compromise question. Without a CVE-specific request signature, use the account and server evidence available in your environment and seek current vendor incident guidance for suspicious activity.