CVE-2026-656608.8HighCWE-94
CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
Vendor fix available · Affected: Microsoft SharePoint Enterprise Server 2016 · Exploitation: in CISA KEV since 25 Sep
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue25 Sep
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub25 Sep
- Not established: not seen
9.8%probability of exploitation in the next 30 days
95th percentile
050100
Higher than 95% of scored CVEs
8.8HighCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 25 Sep · catalogue entry
Passed 42 days ago
DescriptionNVD
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What changed
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage5 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 25 Sep.
Quiet for 6 weekslast report 27 Sep5 articles4 outlets
- Fri 25 Sep, 08:23 UTC. SecurityOnline, first report. Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells. Cites a CVE in CISA KEV.
- Fri 25 Sep, 16:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 17:00 UTC. CISA. CISA Flags Actively Exploited SharePoint and MikroTik Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 21:31 UTC. Security Affairs, its first report on the story. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw. Cites a CVE in CISA KEV.
- Sun 27 Sep, 09:46 UTC. SecurityWeek, its first report on the story. Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 25 Sep 08:23 | SecurityOnline | Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells |
| 25 Sep 16:01 | CISA | CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw |
| 25 Sep 17:00 | CISA | CISA Flags Actively Exploited SharePoint and MikroTik Flaws |
| 25 Sep 21:31 | Security Affairs | CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw |
| 27 Sep 09:46 | SecurityWeek | Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells |
- CISA Flags Actively Exploited SharePoint and MikroTik FlawsCISA · official notice
- CISA Warns of Actively Exploited Microsoft SharePoint Code FlawCISA · official notice
- Attackers Exploit SharePoint Flaw to Deploy Stealthy Web ShellsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.