CVE-2026-65660 Overview
CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to perform spoofing attacks over a network. The flaw stems from improper control of code generation [CWE-94] within SharePoint Server components. An attacker with valid low-privilege credentials can inject crafted content that SharePoint processes as trusted, enabling spoofing of legitimate resources or users. Microsoft has published guidance through its Security Update Guide for affected SharePoint Server editions, including SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
Critical Impact
Authenticated attackers can inject code into SharePoint to spoof trusted content over the network, undermining the confidentiality of user sessions and displayed data.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 (Enterprise)
Discovery Timeline
- 2026-08-11 - CVE-2026-65660 published to the National Vulnerability Database (NVD)
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65660
Vulnerability Analysis
The vulnerability is classified under CWE-94, Improper Control of Generation of Code (Code Injection). SharePoint constructs or renders code segments using attacker-influenced input without adequate neutralization. When an authenticated user with low privileges submits crafted content, SharePoint incorporates it into generated output that other users or backend components treat as trusted.
Exploitation results in a spoofing outcome rather than direct code execution on the server. Attackers can manipulate how content is presented to victims, impersonate trusted SharePoint resources, or influence downstream processing. The vector is network-based with low attack complexity, but requires an authenticated session on the target SharePoint instance.
The EPSS score is 0.683% (49.3 percentile), indicating a moderate near-term exploitation probability relative to other CVEs. No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is insufficient validation and encoding of user-controlled input during code or markup generation within SharePoint request handlers. SharePoint fails to enforce strict output contextual encoding, allowing injected payloads to alter the semantics of the generated response.
Attack Vector
The attacker authenticates to SharePoint with a low-privilege account, then submits crafted input to a vulnerable component. SharePoint incorporates the payload into generated content served to other users or systems, causing spoofed rendering. See the Microsoft Security Update Guide for CVE-2026-65660 for vendor-specific technical detail.
// No verified proof-of-concept code is available.
// Refer to the Microsoft Security Update Guide for technical specifics.
Detection Methods for CVE-2026-65660
Indicators of Compromise
- Unusual authenticated POST or PUT requests to SharePoint list, page, or web part endpoints containing script fragments, markup, or encoded payloads.
- SharePoint ULS logs showing unexpected content transformations or rendering errors originating from low-privilege user accounts.
- Outbound requests or content served from SharePoint that reference domains not associated with the tenant.
Detection Strategies
- Inspect SharePoint audit logs for content modifications by accounts that do not typically author pages, web parts, or list items.
- Monitor IIS logs for HTTP requests to SharePoint endpoints containing suspicious character sequences such as <script, template delimiters, or unusually long encoded parameters.
- Correlate authentication events with content creation events to identify low-privilege accounts producing high-risk content.
Monitoring Recommendations
- Enable SharePoint auditing for content edits, page changes, and list item modifications across all site collections.
- Forward IIS, ULS, and Windows Security logs to a centralized analytics platform for cross-source correlation.
- Alert on spikes of edit or upload activity from accounts recently granted contributor-level permissions.
How to Mitigate CVE-2026-65660
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-65660 to all SharePoint Server 2016, 2019, and Subscription Edition farms.
- Review contributor and higher-privileged accounts across site collections and revoke unnecessary access.
- Rotate credentials for service accounts that interact with SharePoint content APIs if compromise is suspected.
Patch Information
Microsoft has issued a security update for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should consult the Microsoft Security Update Guide for the corresponding KB article and installation guidance for each supported version.
Workarounds
- Restrict content authoring permissions to trusted users until the patch is deployed.
- Enforce multi-factor authentication on all SharePoint accounts to reduce the value of low-privilege credential compromise.
- Deploy a web application firewall in front of SharePoint to inspect and block requests containing suspicious code injection patterns.
# Verify SharePoint build version after patching (run on SharePoint server)
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
