AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canada’s Cyber Centre says SharePoint flaw CVE-2026-65660 is actively exploited for code execution.
86
Product
SharePoint Server Subscription Edition
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 11, 2026
- Last mentionedSep 24, 2026
Timeline
7 articles · newest firstMicrosoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code
CVE-2026-65660 allows authenticated low-privilege users to execute arbitrary code on vulnerable on-premises Microsoft SharePoint servers via a SafeControls bypass.
78
CVE-2026-50522: Patch Critical SharePoint RCE Now
Microsoft patched CVE-2026-50522 (CVSS 9.8), an unauthenticated deserialization RCE in on-premises SharePoint servers, in its July 2026 updates; no exploitation confirmed at disclosure.
72
CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability
CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.
74
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.
74
2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
90
2026-004: Critical Vulnerability in SharePoint Exploited
CVE-2026-20963 (CVSS 9.8), an unauthenticated RCE in on-prem SharePoint, was added to CISA's KEV on 18 March 2026 and is actively exploited.
90
Related CVEs
by mentions- CVE-2026-505223%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-656608%8.8Authenticated Code Injection RCE in Microsoft SharePoint Server
- CVE-2026-2096329%9.8Deserialization RCE in Microsoft SharePoint Exploited in the Wild
- CVE-2026-5864416%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-4565980%8.8Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)
- CVE-2026-3220143%6.5Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server
- CVE-2026-261143%8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
- CVE-2026-635203%8.1Unauthenticated RCE in Microsoft SharePoint Server
- CVE-2026-26113<1%7.8Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally
Appears with
- Microsoftvendor · 7
- SharePoint Server 2019product · 5
- CISAorganization · 3
- SharePoint Server 2016product · 3
- Microsoftorganization · 3
- CISAvendor · 2
- SharePoint Enterprise Server 2016product · 2
- SharePoint Serverproduct · 2
- CERT-EUorganization · 2
- Canadian Centre for Cyber Securityorganization · 1
- Viettel Cyber Securityorganization · 1
- SharePoint Server 2016 Enterpriseproduct · 1
- Microsoft SharePoint Enterprise Server 2016product · 1
- WatchTowrorganization · 1
- Rapid7organization · 1
- SentinelOnevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.