Full Report
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Analysis Summary
# Vulnerability: Microsoft SharePoint Server Code Injection
## CVE Details
- **CVE ID:** CVE-2026-65660
- **CVSS Score:** Not explicitly listed in the article (High/Critical severity implied by RCE impact)
- **CWE:** CWE-94: Improper Control of Generation of Code ('Code Injection')
## Affected Systems
- **Products:** Microsoft SharePoint Server
- **Versions:**
- Microsoft SharePoint Enterprise Server 2016: All versions prior to 16.0.5565.1001
- Microsoft SharePoint Server 2019: All versions prior to 16.0.10417.20198
- Microsoft SharePoint Server Subscription Edition: All versions prior to 16.0.19725.20522
- **Configurations:** Systems configured to permit anonymous access are at higher risk; however, the flaw generally requires authentication unless chained with other vulnerabilities.
## Vulnerability Description
This is a Code Injection vulnerability that allows an authenticated attacker to execute arbitrary code on vulnerable SharePoint servers. The flaw stems from improper control of the generation of code. When chained with other existing SharePoint vulnerabilities, it can be leveraged to achieve pre-authentication Remote Code Execution (RCE).
## Exploitation
- **Status:** Exploited in the wild (Active exploitation reported by the Cyber Centre)
- **Complexity:** Not specified, but elevated risk for organizations with unpatched legacy updates.
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Arbitrary code execution)
- **Integrity:** High (Ability to modify configuration and web parts)
- **Availability:** High (Potential for full system compromise)
## Remediation
### Patches
Update to the following fixed versions immediately:
- **SharePoint Enterprise Server 2016:** Version 16.0.5565.1001
- **SharePoint Server 2019:** Version 16.0.10417.20198
- **SharePoint Server Subscription Edition:** Version 16.0.19725.20522
*Note: SharePoint 2016 and 2019 reached End of Life on July 15, 2026. Migration to a supported version is urged.*
### Workarounds
- Restrict or eliminate direct internet exposure of SharePoint servers.
- Limit access to SharePoint Central Administration and management interfaces.
- Enforce Multi-Factor Authentication (MFA) for all administrative and privileged accounts.
- Enable Antimalware Scan Interface (AMSI) and configure "Request Body Scan Mode" to "Full Mode."
## Detection
- **Indicators of Compromise:**
- Unusual administrative activity or unauthorized web part modifications.
- Suspicious access to IIS machine keys.
- Evidence of deserialization attacks or web shell deployment.
- Unexpected malicious process execution.
- **Detection Methods:**
- Monitor IIS, endpoint security, and authentication logs for privilege escalation.
- Utilize Microsoft Defender or AMSI for specific SharePoint exploitation detections.
## References
- Vendor Advisory: hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-65660
- Canadian Centre for Cyber Security Alert: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660
- CWE-94 Definition: hxxps[://]cwe[.]mitre[.]org/data/definitions/94[.]html