CVE-2026-65660: CISA Flags Exploited SharePoint Code Injection

CVE-2026-65660 Moves From "Spoofing" to Actively Exploited SharePoint RCE​

The most useful context for the SharePoint entry is how it was first labeled. When Microsoft shipped its August 11, 2026 security updates, CVE-2026-65660 arrived in the advisory bulletin as a spoofing vulnerability in SharePoint Server carrying a CVSS score of 6.5, moderate, no stated impact on integrity or availability, exploitation rated "Less Likely." Microsoft's Security Update Guide entry still shows that framing. It lists the impact as spoofing and the maximum severity as Important, but it also assigns CWE-94: Improper Control of Generation of Code ('Code Injection').

The CVE record tells a different story. The CVE record states the flaw allows an authorized attacker to execute code over a network, and third-party trackers now show a CVSS 3.1 base score of 8.8 (HIGH). One tracker reports the record was last revised at NVD Sept. 25, 2026, the day of the KEV listing. So the Security Update Guide label and the CVE record disagree. A team that sorted its August Patch Tuesday backlog by Microsoft's original severity may have set this one aside.

The Hacker News explained how that happened. It reported that defenders who triaged CVE-2026-65660 based on the advisory saw a moderate spoofing flaw, not a code-execution vulnerability with a near-maximum score. The detailed write-up came from researcher Dinh Ho Anh Khoa, who, according to The Hacker News, demonstrated the original ToolShell exploit chain against SharePoint at Pwn2Own Berlin in May 2025.

The mechanism involves SharePoint's safety list for web-part controls. Per The Hacker News, the flaw sits in how SharePoint checks whether server-side controls are on the SafeControls list, a filter that prevents dangerous classes from loading. When the ToolPane component processes web-part markup, it reconstructs Register directives by writing attribute values between double quotes without escaping quotes inside them. In practice, an authenticated user can get classes past a filter meant to block them and then run code inside the SharePoint server.

Exploitation of the SharePoint Flaw Followed Public Exploit Details Within Days​

The timeline is short. As recently as September 22, The CyberSec Guru reported that no confirmed in-the-wild exploitation has been reported as of September 22, 2026, and the flaw is not listed in CISA's KEV catalog. The Hacker News likewise noted that Microsoft's advisory rates exploitation as unlikely, though the full exploit markup is now public.

Two days later, Canada's national cyber agency changed that picture. On September 24, the Canadian Centre for Cyber Security said it is aware of active exploitation of a vulnerability affecting Microsoft SharePoint Server. It also warned that chained with other SharePoint vulnerabilities, this vulnerability can achieve pre-authentication remote code execution on SharePoint servers configured to permit anonymous access. That warning matters because the CVSS vector requires low privileges. By itself the bug needs a logged-in user, but chained with other flaws it may need no account at all.

SecurityOnline has reported what that chaining looks like in real attacks. It cites threat-intelligence firm Previdian, which said: "Previdian observed SharePoint exploit attempts chaining CVE-2026-65660 (authenticated) with a separate anonymous delivery bug documented by @vcslab." According to the same report, these attacks deliver an encrypted loader to establish server control. The Previdian observations come through that one outlet, but the Canadian government's independent confirmation of active exploitation supports CISA's rationale.

One more gap is worth knowing about. According to HOL's write-up, MSRC still lists exploited: No on the advisory; CISA's KEV listing is the later exploitation signal. Any patch dashboard that pulls "exploited" status from Microsoft's feed may be showing stale data for this CVE.

Which SharePoint Server Builds Fix CVE-2026-65660​

The affected products are all on-premises SharePoint Server releases. The fixed builds are the August 2026 security updates. Both the Canadian Cyber Centre and the CVE record list the same version boundaries:

For Subscription Edition, Microsoft's support article for KB5002893 (August 11, 2026) identifies build 16.0.19725.20522 as the security update package. It lists CVE-2026-65660 among the vulnerabilities it fixes, and it supersedes the earlier update KB5002882. A third-party vulnerability tracker says Microsoft provides fixes through advisories KB5002905, KB5002906, and KB5002894. WindowsForum has not matched those numbers to specific editions against Microsoft's support pages. The safest check is to compare the installed build against the table above rather than rely on a KB number.

SharePoint 2016 and 2019 shops face a bigger decision. The Cyber Centre notes that SharePoint Enterprise Server 2016 and Server 2019 are end of life as of July 15, 2026, and urges organizations to move to a supported version. Fixed builds exist for both for this CVE. Even so, a farm on either version is now running software whose support clock has run out.

Older versions may be exposed too. Khoa says the flaw also affects SharePoint 2013, though Microsoft's advisory lists only 2016, 2019, and Subscription Edition. SharePoint 2013 has been out of support since April 2023 and receives no security updates. If you still run a 2013 farm, no patch is coming for it. Your only options are to isolate it or migrate. The sources reviewed do not say SharePoint Online is affected, and the advisories address only on-premises servers.

KB5002893 Carries Workflow Manager Prerequisites and Feature Changes​

The Subscription Edition update comes with prerequisites that can break things if skipped. Microsoft's KB5002893 article says farms running the current SharePoint Workflow Manager must install the Workflow Manager update, KB5002799, before this cumulative update. Farms still on the classic Workflow Manager must turn on a debug flag to keep using it. Microsoft gives this PowerShell sequence for that case:

1. Run $farm = Get-SPFarm to get the farm object.
2. Run $farm.ServerDebugFlags.Add(53601) to add the flag.
3. Run $farm.update() to save the change.
4. Run iisreset to restart IIS.

These instructions apply to Subscription Edition and should not be assumed for 2016 or 2019 farms. Microsoft offers the package through Microsoft Update, the Microsoft Update Catalog and the Microsoft Download Center. The standalone file is uber-subscription-kb5002893-fullfile-x64-glb.exe.

The same KB announces feature lockdowns that tie directly to this bug. Microsoft says the ToolPane feature is disabled starting with the September 2026 public update, and admins can turn it back on per site collection with the Enable-SPToolPane cmdlet. The researcher says the August 11 patch fixes the flaw and turns off the vulnerable function by default. ToolPane is the component where the quoting flaw lives. Our inference: re-enabling ToolPane on an exposed farm gives back part of the hardening, so it should be a deliberate choice, not the first fix tried when a web-part page breaks.

KB5002893 also turns off or schedules off several other legacy features. They include file-based Business Data Connectivity model import (re-enabled with Enable-BdcmFileImport), SharePoint 2010 workflows (Enable-SPLegacyWorkflow), Exchange autodiscovery in OWA web parts (Enable-SPOWAWebPartAutodiscovery) and ExecuteProxyUpdates (Enable-SPWebPartPagesProxyUpdates). Microsoft also warns that orphaned remote event receivers with no app identifier will be blocked from the November 2026 update. You can find them with Get-SPOrphanedRemoteEventReceiver. Expect some functional side effects after patching and plan testing for them.

CVE-2026-67279 Targets RouterOS SSH Rekeying​

The second KEV entry covers MikroTik RouterOS. CISA's alert names it as an improper enforcement of behavioral workflow vulnerability. CERT Polska published it on September 5, 2026, as one of several RouterOS issues disclosed together. It classifies the bug as CWE-841 and lists these affected ranges:

• RouterOS 7.24 up to, but not including, 7.24.2 is affected.
• RouterOS 7.0.0 up to, but not including, 7.23.4 is affected.
• RouterOS 6.0.0 up to, but not including, 6.49.21 is affected.

CERT Polska describes the flaw like this. After a client asks for an SSH rekey (a mid-session renegotiation of encryption keys), an affected RouterOS build can move on to the connection stage without ever attempting user authentication. An unauthenticated client can then open a session channel and send a command, which the router may run. According to CERT Polska, that lets an attacker create, overwrite and rebuild files in RouterOS's managed file area. That includes support files holding configuration and diagnostic data. This description applies only to CVE-2026-67279, not to the other RouterOS bugs in the same disclosure.

MikroTik's September 3 security notice says fixes are available in all release channels, including 7.24.2, 7.23.4, 6.49.21 and 7.25 beta 3. The vendor says most configurations are not at risk but still recommends upgrading. It also says it held back details at first so users had time to update. Exposure depends heavily on whether SSH can be reached. MikroTik says the default configuration blocks SSH from the internet. Users who opened it manually should limit it to trusted IPs or put it behind a VPN such as WireGuard.

MikroTik also describes a built-in compromise check. RouterOS logs a critical "Flagged" status if it detects compromise. The vendor still advises checking configurations after updating for unfamiliar scripts, users or other changes, even when nothing is flagged. For this CVE, CISA's listing is the only exploitation evidence found in this research. No second outlet has reported details of in-the-wild attacks.

BOD 26-04 Gives the KEV Listing a Three-Day Federal Clock​

CISA's alert frames both additions under Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," issued June 10, 2026. It replaced and merged two older directives: BOD 19-02, which covered internet-accessible systems, and BOD 22-01, which created the KEV mandate. CISA's announcement at the time said the directive establishes a prioritization structure for patching efforts based on asset exposure, KEV status, exploit automation, and post-exploitation technical impact. Under this model, deadlines depend on risk, so KEV entries no longer all carry the same due date.

For the SharePoint entry, the deadline is very short. Per a CVE tracker that mirrors the catalog, CISA listed this CVE in the Known Exploited Vulnerabilities catalog on Sept. 25, 2026, with a federal remediation deadline of Sept. 28, 2026. HOL's summary reports the same due date and adds that forensic triage is marked Yes under BOD 26-04. Known ransomware campaign use is Unknown. The forensic flag matters. Under BOD 26-04, in the scenarios the directive sets out, agencies must check whether an adversary got in before the patch was applied. Patching alone is not enough. The research did not turn up a due date for the RouterOS entry.

BOD 26-04 binds only Federal Civilian Executive Branch agencies. CISA encourages everyone else to use risk-based vulnerability management and put KEV entries near the top of the list. The KEV catalog page itself says organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

What SharePoint and MikroTik Admins Should Do Before September 28​

If you run SharePoint on-premises, act now. Don't wait for the next patch cycle. A public exploit, observed chaining attacks and a three-day federal deadline together make CVE-2026-65660 an emergency for any farm below the fixed builds. That goes double for farms reachable from the internet or that allow anonymous access. RouterOS owners with SSH closed to untrusted networks have less urgent exposure, but they should still upgrade.

The Canadian Cyber Centre's guidance adds useful hardening and hunting steps for SharePoint:

• Find every on-premises SharePoint Server farm, especially internet-facing ones. Confirm each one's build is at or above 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) or 16.0.19725.20522 (Subscription Edition).
• On Subscription Edition, install Workflow Manager update KB5002799 before KB5002893, or set debug flag 53601 if you still use classic Workflow Manager.
• Enable AMSI (Antimalware Scan Interface) integration for SharePoint web applications and set AMSI Request Body Scan Mode to Full Mode where you can. Also limit internet access to SharePoint Central Administration.
• Look through SharePoint, IIS, endpoint and authentication logs for signs the Cyber Centre flags. These include unexpected web-part changes, suspicious access to IIS machine keys, web shells, deserialization activity and Microsoft Defender or AMSI detections tied to SharePoint.
• Upgrade MikroTik devices to RouterOS 7.24.2, 7.23.4 or 6.49.21 or later. Limit SSH to trusted IPs or a VPN. Check for unfamiliar scripts or users even if RouterOS shows no "Flagged" status.
• Plan migrations for SharePoint 2016 and 2019 farms, which are past end of life. SharePoint 2013 farms should be isolated, because no fix exists for them.

The SharePoint case has a lesson that goes beyond this one bug. A CVE labeled "spoofing, less likely to be exploited" in August turned out to be an authenticated code-execution bug, got a public exploit, and was being chained in real attacks within about six weeks. Microsoft's advisory still shows the older label. For federal agencies, the September 28 deadline includes checking whether the server was already compromised. For everyone else running on-premises SharePoint, the same approach applies: install the August 2026 builds, then look through the logs for evidence of intrusion from before the patch.