Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
Product
SharePoint
Added to KEV
25 Sep 2026
Federal remediation due
28 Sep 2026
Known ransomware use
Not reported
What changed
CISA KEV: Listed 25 Sep 2026; remediation due 28 Sep 2026 → Listed 25 Sep 2026 · Title changed
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → No (MSRC assessment) · Exploitation detected: Not reported by MSRC → No known exploitation (MSRC assessment)
Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
4 Nov 2026 · 21:21:22 UTCLink: KB5002906/windows/kb/KB5002906 → No longer listed in this observation
4 Nov 2026 · 21:21:22 UTCLink: KB5002905/windows/kb/KB5002905 → No longer listed in this observation
4 Nov 2026 · 21:21:22 UTCLink: KB5002896/windows/kb/KB5002896 → No longer listed in this observation
4 Nov 2026 · 21:21:22 UTCLink: KB5002894/windows/kb/KB5002894 → No longer listed in this observation
4 Nov 2026 · 21:21:22 UTCLink: KB5002893/windows/kb/KB5002893 → No longer listed in this observation
4 Nov 2026 · 21:21:22 UTCLink: August 2026/security?release=2026-Aug#cves → No longer listed in this observation
4 Nov 2026 · 21:21:22 UTCSourceMicrosoft Security Response Center → CISA Known Exploited Vulnerabilities
4 Nov 2026 · 21:21:22 UTCSummaryImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. → Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
4 Nov 2026 · 21:21:22 UTCTitleMicrosoft SharePoint Server Remote Code Execution Vulnerability → Microsoft SharePoint Code Injection Vulnerability
CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
CVE-2026-65660
Listed in CISA KEV · added 25 Sep 2026 · Microsoft · SharePoint
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.