SharePoint code injection hits CISA KEV

Originally published at HOL

CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities catalog today (2026-09-25). Microsoft published the SharePoint Server Remote Code Execution row in the August 2026 security update (2026-08-11). Impact is Remote Code Execution via code injection (CWE-94). Severity is Important, CVSS 3.1 base 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Federal KEV due date is 2026-09-28. Forensic triage is marked Yes under BOD 26-04. Known ransomware campaign use is Unknown. MSRC still lists exploited: No on the advisory; CISA's KEV listing is the later exploitation signal. Do not treat MSRC's August wording as a clean bill of health after today.

This is the operator write-up from MSRC CVE-2026-65660, the August 2026 SharePoint KBs, CISA KEV catalogVersion 2026.09.25, and NVD. The HOL Guard evidence pack for this CVE, when it lands, is the linked source record; this page is the fix-first summary.

What breaks

MSRC rates this Important Remote Code Execution. An authenticated attacker with low-level access can send a specially crafted request and execute code on the SharePoint server. User interaction is not required. On-prem farms that still sit below the August 2026 fixed builds are the pager case, especially internet-facing SharePoint hosts where low-priv accounts are common.

Affected product lines and fixed builds from MSRC affectedProduct (release 2026-Aug):

SharePoint Server Subscription Edition: KB5002893 → build 16.0.19725.20522
SharePoint Server 2019: KB5002894 → build 16.0.10417.20198
SharePoint Enterprise Server 2016 (same KB also covers SharePoint Server 2016): KB5002905 → build 16.0.5565.1001

Reboot guidance on those rows is Maybe. If multiple updates apply for the software on the box, MSRC FAQ says install all of them; order does not matter.

Who is not in scope

SharePoint Online / Microsoft 365 cloud SharePoint. MSRC lists only the three on-prem server SKUs above. This KEV row is not a SharePoint Online patch ticket.
Farms already on or above the August 2026 fixed builds for your SKU (SE 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001).
Unauthenticated internet worms as the PR:L model. The CVSS privileges-required is Low, not None. You still need an authorized (low-priv) attacker who can reach the farm.
Other Microsoft products outside those SharePoint Server trains named on this CVE. Patch them on their own advisories; do not treat 65660 as coverage for unrelated MSRC rows.

One operator check

On a SharePoint server, print the installed product build, then compare it to the fixed build for your SKU:

# SharePoint Management Shell / elevated PowerShell
(Get-SPFarm).BuildVersion.ToString()
# or, from the binaries folder for your train:
(Get-Item "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.dll").VersionInfo.FileVersion

You want at least 16.0.19725.20522 (Subscription Edition), 16.0.10417.20198 (2019), or 16.0.5565.1001 (2016 / Enterprise 2016). Anything lower on that train is still open for this KEV row.

How to fix

Install the August 2026 security update for your SharePoint Server SKU, then confirm the build:

Subscription Edition: KB5002893 → build 16.0.19725.20522
SharePoint Server 2019: KB5002894 → build 16.0.10417.20198
SharePoint Server 2016 / Enterprise Server 2016: KB5002905 → build 16.0.5565.1001

Prefer the path your farm already uses (WSUS / ConfigMgr / manual KB). After the update, re-run the build check above. Federal agencies under BOD 26-04 also owe forensic triage before or with the patch window; the KEV due date is 2026-09-28.

What this is not

This is not unauthenticated remote code execution. Privileges required are Low (an authorized attacker), not None. It is also not a first-day disclosure story: the MSRC update shipped 2026-08-11. Treat it as authenticated code injection RCE that CISA now says is known-exploited, on widely deployed on-prem SharePoint.