Microsoft SharePoint Code Injection Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-65660, a Microsoft SharePoint code injection vulnerability, to the Known Exploited Vulnerabilities Catalog on 25 September 2026 (catalog version 2026.10.21). The vulnerability is CWE-94, code injection, which could allow an authorized attacker to execute code over a network. CISA's remediation due date for federal civilian agencies is 28 September 2026. The fixed versions are Microsoft SharePoint Enterprise Server 2016 16.0.5565.1001 and Microsoft SharePoint Server 2019 16.0.10417.20198. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.021 probability of exploitation (82nd percentile, 2026-10-23). CISA's ADP records SSVC exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record names the fixed versions to check against: Microsoft SharePoint Enterprise Server 2016 16.0.5565.1001 and Microsoft SharePoint Server 2019 16.0.10417.20198. The record lets this reader verify whether deployed SharePoint instances are at or above those versions and patch or isolate any that are not.

For a cyber underwriter, the record provides the CVE id, the catalog entry date, and the fixed versions to check a policyholder's estate against. The record lets this reader price or require a control by confirming whether insured SharePoint deployments have applied the named fixed versions.

What would change this call

A change to the catalog entry — a revised due date, a different fixed version, or a ransomware-use designation — would change what a reader checks. A vendor advisory naming additional affected versions would also change the check.

What to check next

Confidence

Filed 25 October 2026 from the record dated 25 September 2026.

Sources

[1] Microsoft SharePoint Code Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-65660

[2] CVE record CVE-2026-65660 — https://www.cve.org/CVERecord?id=CVE-2026-65660

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog