Code injection in on-premises SharePoint Server gives remote code execution (CVE-2026-65660)
The Canadian Centre for Cyber Security issued alert AL26-023 on 2026-09-24 stating it is aware of active exploitation of this CVE, and servers still on pre-August builds are exposed to server-side code execution.
A code-injection flaw in SharePoint Server lets an attacker with low-level access send a crafted request that executes code on the server; the Canadian Centre for Cyber Security's alert notes the flaw is reachable on servers configured to permit anonymous access, making the effective bar lower than the CVSS PR:L suggests. Patched in the August 2026 SharePoint security updates.
Affected: SharePoint Enterprise Server 2016 < 16.0.5565.1001; SharePoint Server 2019 < 16.0.10417.20198; SharePoint Server Subscription Edition < 16.0.19725.20522
How to Test
Check the farm build in Central Administration (Servers in Farm / Manage Patch Status): 2016 below 16.0.5565.1001, 2019 below 16.0.10417.20198, or Subscription Edition below 16.0.19725.20522 is vulnerable. Review IIS and ULS logs for unexpected crafted requests from anonymous or low-privilege accounts, and check for unfamiliar .aspx or other files dropped in the SharePoint web roots and layouts directories since August.
How to Patch
Install all August 2026 (or later) SharePoint security updates offered for your version so the build reaches 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) or 16.0.19725.20522 (Subscription Edition); Microsoft notes multiple packages may apply and all must be installed. Where patching must wait, restrict internet access to the server and disable anonymous access.