AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canada’s Cyber Centre says SharePoint flaw CVE-2026-65660 is actively exploited for code execution.
The Canadian Centre for Cyber Security alert AL26-023 says CVE-2026-65660, a code-injection flaw (CWE-94) in Microsoft SharePoint Server, is being actively exploited. An authenticated attacker can execute arbitrary code, and chaining it with other SharePoint bugs can yield pre-authentication remote code execution where anonymous access is allowed. Fixed versions are 16.0.5565.1001 for Server 2016, 16.0.10417.20198 for Server 2019, and 16.0.19725.20522 for Subscription Edition. SharePoint 2016 and 2019 reached end of life on July 15, 2026; the centre urges patching, migration, MFA, AMSI Full Mode, and monitoring for web shells and suspicious IIS activity.
- CVE-2026-65660 is code injection in on-premises SharePoint.
- Active exploitation is reported; chaining can enable pre-auth RCE.
- Fixed builds are listed for 2016, 2019, and Subscription Edition.
- SharePoint 2016 and 2019 went end of life on July 15, 2026.
- CVEs
- CVE-2026-65660
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
From the original article
3 min read at cyber.gc.ca
Number: AL26-023 Date: September 24, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.