Microsoft SharePoint Flaw Lets Attackers Execute Code Remotely With Low Privileges
Microsoft patched CVE-2026-65660, an authenticated SharePoint Server remote code execution flaw scored 8.8.
Microsoft confirmed CVE-2026-65660, a CVSS 8.8 code-injection flaw in on-premises SharePoint Server 2016, 2019, and Subscription Edition. An authenticated, low-privileged attacker can run arbitrary code over the network without user interaction. Viettel Cyber Security described a SafeControls bypass in ToolPane Register-directive handling that can reach in-memory code execution, and public research includes working exploit markup. Fixes were released on August 11, 2026; Microsoft said the vulnerability had not been exploited, while a separate anonymous-access chain was closed in a June update.
- CVE-2026-65660 scores 8.8 and requires only low privileges.
- SharePoint Server 2016, 2019, and Subscription Edition are affected.
- Public research includes working exploit markup and an in-memory webshell.
- Microsoft said the flaw was not known to be exploited.
- Unsupported SharePoint 2013 is affected but will not be patched.
- CVEs
- CVE-2026-65660
- Vendors
- Microsoft
- Products
- SharePoint Server
- Organizations
- MicrosoftViettel Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
From the original article
3 min read at cybersecuritynews.com
Microsoft has confirmed a high-severity remote code execution vulnerability in on-premises SharePoint Server that lets an authenticated, low-privileged attacker run arbitrary code over a network without user interaction. Tracked as CVE-2026-65660, the code-injection flaw carries a CVSS score of 8. 8 and affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.