plaincve:~$

// threat brief

CVE-2026-65660Actively exploited

SharePoint Server code injection: first listed as "spoofing", it actually lets a low-privilege user run code on the server

CVSS
8.8 HIGH
CISA KEV
2026-09-25
Weakness
CWE-94
Topics
Web apps · Infrastructure

PlainCVE Team · Published 2026-10-11 · AI-assisted · Press brief ↓

AI review 2026-10-11 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

A code injection flaw in self-hosted SharePoint Server lets any logged-in, low-privilege user run code on the server. Microsoft confirms attacks.

Who is affectedOrganizations running self-hosted SharePoint Enterprise Server 2016, SharePoint Server 2019 or SharePoint Server Subscription Edition without the August 11, 2026 (or later) security update. The FAQ in Microsoft's advisory adds that the same KB applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016, and customers running either version should install the security update. SharePoint Online is not listed as affected.
What happensAn attacker with only a low-privilege account can run code on the SharePoint server over the network, with high impact on confidentiality, integrity and availability. Researchers say that if another unpatched bug is present and the site allows anonymous viewing, no login may be needed at all.
What to do nowInstall the August 11, 2026 or later SharePoint security update now. Per Microsoft Learn, 2016 and 2019 need both the STS update and the language-pack (WSSLOC) update; installing only one is not enough. Also check server logs for signs of compromise.
Affected versionsSharePoint Enterprise Server 2016 before 16.0.5565.1001; SharePoint Server 2019 before 16.0.10417.20198; SharePoint Server Subscription Edition before 16.0.19725.20522. The FAQ in Microsoft's advisory says the same KB also applies to SharePoint Server 2016 (non-Enterprise), and customers running either version should install it. The researcher says SharePoint 2013 is also affected, but Microsoft's advisory does not list it.
Fixed versions2016: 16.0.5565.1001 (STS update KB5002905 and language-pack update KB5002906, both required); 2019: 16.0.10417.20198 (STS update KB5002894 and language-pack update KB5002896, both required); Subscription Edition: 16.0.19725.20522 (KB5002893).
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-08-11
CISA KEVListed (2026-09-25): attacks have been seen in the wild

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check whether your SharePoint build is below the fixed build

    Run on a SharePoint server in the SharePoint Management Shell. This is PlainCVE's command (not taken from Microsoft documentation); it only reads the build number and changes nothing. Affected if 2016 is below 16.0.5565.1001, 2019 below 16.0.10417.20198, or Subscription Edition below 16.0.19725.20522. SharePoint Online is not listed as affected. Note that this build number alone does not prove the 2016 or 2019 language-pack (WSSLOC) update is installed; per Microsoft Learn both updates are required, so confirm both KBs are installed separately.

    Read-only check
    (Get-SPFarm).BuildVersion
  2. 02Search for suspicious POST requests

    Previdian suggests starting with POSTs to AddGallery.aspx and designgallery.aspx, including paths with repeated /_layouts/ segments. This is researcher advice, not Microsoft detection guidance. Run in PowerShell on the SharePoint server (IIS host); the command searches the log folder and all its subfolders (such as the W3SVC folders). This is PlainCVE's command; it only reads logs and changes nothing.

    Read-only check
    Get-ChildItem -Path '<IIS log folder>' -Filter *.log -Recurse | Select-String -Pattern 'AddGallery.aspx','designgallery.aspx' | Select-String 'POST'
    Step 2
  3. 03Search for the known web shell name

    Previdian reports the attack creates /_layouts/15/sphealth.aspx. Run in PowerShell on the SharePoint server (IIS host); the command searches the log folder and all its subfolders. This is PlainCVE's command; it only reads logs and changes nothing.

    Read-only check
    Get-ChildItem -Path '<IIS log folder>' -Filter *.log -Recurse | Select-String -Pattern 'sphealth.aspx'
    Step 5
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Install the August 11, 2026 or later security update

    Microsoft says to apply all updates offered for the installed software, in any order. Per Microsoft Learn, SharePoint updates are cumulative, but each 2016 and 2019 release has a language-independent STS update and a language-dependent WSSLOC update, and both are required to fully update the farm (2016 - KB5002905 plus KB5002906; 2019 - KB5002894 plus KB5002896; or the latest STS and WSSLOC updates after them). Subscription Edition has a single update (KB5002893 or later).

    Step 3Step 4
  2. 02Also make sure the June fix is installed

    The researcher says the anonymous (no-login) chain needs a separate authentication-bypass bug fixed on June 9; servers with that fix are not exposed to the pre-authentication path. Its CVE ID is not known.

    Step 1
  3. 03Can't patch yet: review anonymous access

    Our sources contain no Microsoft workaround. Field Effect advises reviewing settings that allow anonymous page access to remove a condition the no-login chain needs; this does not replace patching and does not stop logged-in attackers.

    Step 1
RESPONDRespondIf you find signs of compromise
  1. 01Check for in-memory web shells

    Field Effect warns some web shells live only in memory and write nothing to disk, so checking files alone is not enough; review endpoint telemetry.

    Step 5
  2. 02Treat a sphealth.aspx hit as a compromise

    Patching closes the hole but does not remove a backdoor already planted. Our sources contain no Microsoft incident-response guidance; PlainCVE suggests treating any sign of this file or access to it as a security incident.

    Step 4Step 5
HARDENHardenPrevent the next one
  1. 01Plan a move to a supported version

    The Canadian Cyber Centre says SharePoint Enterprise Server 2016 and Server 2019 reached end of life on July 15, 2026. SharePoint 2013, which the researcher says is also affected, gets no security updates.

    Step 3
  2. 02Avoid allowing anonymous viewing

    Anonymous access is one of the conditions the no-login chain needs.

    Step 1
Full remediation steps and notes

Per Microsoft Learn, SharePoint updates are cumulative, but each 2016 and 2019 release has two updates: a language-independent STS update and a language-dependent WSSLOC update that covers all language packs, including English installations, and “both updates are required to fully update the farm”. So 2016 needs both KB5002905 and KB5002906, and 2019 needs both KB5002894 and KB5002896 (or the latest STS and WSSLOC updates after them); installing only one does not fully fix it. For Subscription Edition, KB5002893 or any later update is enough. Microsoft says to apply all updates offered for the installed software, in any order.

Check your build (run on a SharePoint server in the SharePoint Management Shell; PlainCVE’s command, read-only): (Get-SPFarm).BuildVersion, and compare it with the fixed builds in the table above. This build number alone does not prove the 2016 or 2019 language-pack (WSSLOC) update is installed; confirm both the STS and WSSLOC KBs are installed.

Caveats:

  • 2016 and 2019 are end of life. The Canadian Cyber Centre says both reached end of life on July 15, 2026. Microsoft still shipped updates for this flaw; install them first, then plan a migration.
  • SharePoint 2013 gets no security updates; if the researcher is right, PlainCVE suggests retiring or migrating it (reviewing anonymous access reduces but does not remove the risk).
  • If you can’t patch right away: our sources contain no Microsoft workaround. Field Effect advises reviewing anonymous page access, which only blocks the no-login chain, not attackers who have an account.
  • Check for compromise even after patching. Patching does not remove a backdoor already planted. Per Previdian and Field Effect, look for POSTs to AddGallery.aspx and designgallery.aspx, access to /_layouts/15/sphealth.aspx, and in-memory web shells.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

SharePoint Server code injection: first listed as "spoofing", it actually lets a low-privilege user run code on the server: 1. The attacker gets a low-privilege SharePoint account → 2. Sends a specially crafted request over the network → 3. SharePoint treats attacker-controlled content as code → 4. Code runs on the SharePoint server → 5. Leaves a web shell backdoorCVE-2026-65660 · SharePoint Server code injection: first listed as "spoofing", it actually lets alow-privilege user run code on the serverAttackerYour systemThe attacker gets a low-privilege SharePoint account — Microsoft says only low-level access is needed, not admin rights. Researchers add that if the site allows anonymous viewing and a separate June authentication-bypass bug is unpatched, this step can be skipped. 1The attacker getsa low-privilegeSharePoint accountSends a specially crafted request over the network — No other user has to click anything. Previdian advises defenders to start by looking for POSTs to AddGallery.aspx and designgallery.aspx. 2Sends a speciallycrafted requestover the networkSharePoint treats attacker-controlled content as code — This is code injection (CWE-94): the server does not properly control input when generating code. 3SharePoint treatsattacker-controlledcontent as codeCode runs on the SharePoint server — The attacker can run code of their choosing on the server. 4Code runs on theSharePoint serverLeaves a web shell backdoor — Previdian reports the attack creates a web shell at /_layouts/15/sphealth.aspx; Field Effect warns there may also be in-memory web shells that write no file to disk. 5Leaves a web shellbackdoorAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-65660-sharepoint-server-code-injection-rce · CC BY 4.0
SharePoint Server code injection: first listed as "spoofing", it actually lets a low-privilege user run code on the server: 1. The attacker gets a low-privilege SharePoint account → 2. Sends a specially crafted request over the network → 3. SharePoint treats attacker-controlled content as code → 4. Code runs on the SharePoint server → 5. Leaves a web shell backdoorCVE-2026-65660 · SharePoint Server codeinjection: first listed as "spoofing",it actually lets a low-privilege userrun code on the serverThe attacker gets a low-privilege SharePoint account — Microsoft says only low-level access is needed, not admin rights. Researchers add that if the site allows anonymous viewing and a separate June authentication-bypass bug is unpatched, this step can be skipped. 1AttackerThe attacker gets alow-privilege SharePoint accountSends a specially crafted request over the network — No other user has to click anything. Previdian advises defenders to start by looking for POSTs to AddGallery.aspx and designgallery.aspx. 2AttackerSends a specially craftedrequest over the networkSharePoint treats attacker-controlled content as code — This is code injection (CWE-94): the server does not properly control input when generating code. 3Your systemSharePoint treatsattacker-controlled content ascodeCode runs on the SharePoint server — The attacker can run code of their choosing on the server. 4Your systemCode runs on the SharePointserverLeaves a web shell backdoor — Previdian reports the attack creates a web shell at /_layouts/15/sphealth.aspx; Field Effect warns there may also be in-memory web shells that write no file to disk. 5AttackerLeaves a web shell backdoorAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-65660-sharepoint-server-code-injection-rce
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker gets a low-privilege SharePoint account

    Microsoft says only low-level access is needed, not admin rights. Researchers add that if the site allows anonymous viewing and a separate June authentication-bypass bug is unpatched, this step can be skipped.

    Defense: Install the June and August security updates; review settings that allow anonymous page access (Field Effect's advice).

  2. Attacker

    Sends a specially crafted request over the network

    No other user has to click anything. Previdian advises defenders to start by looking for POSTs to AddGallery.aspx and designgallery.aspx.

    Defense: Monitor logs for POSTs to these two pages, including paths with repeated /_layouts/ segments.

  3. Your system

    SharePoint treats attacker-controlled content as code

    This is code injection (CWE-94): the server does not properly control input when generating code.

    Defense: Install the 2026-08-11 or later update; the researcher says the patch also turns off the vulnerable function by default.

  4. Your system

    Code runs on the SharePoint server

    The attacker can run code of their choosing on the server.

  5. Attacker

    Leaves a web shell backdoor

    Previdian reports the attack creates a web shell at /_layouts/15/sphealth.aspx; Field Effect warns there may also be in-memory web shells that write no file to disk.

    Defense: Search for access to sphealth.aspx, and use endpoint telemetry to check for memory-resident activity.

Who is affected

ProductAffectedFixed (security update)
SharePoint Enterprise Server 2016Before 16.0.5565.100116.0.5565.1001 (STS update KB5002905 and language-pack update KB5002906; both required)
SharePoint Server 2019Before 16.0.10417.2019816.0.10417.20198 (STS update KB5002894 and language-pack update KB5002896; both required)
SharePoint Server Subscription EditionBefore 16.0.19725.2052216.0.19725.20522 (KB5002893)
SharePoint Server 2016 (non-Enterprise)Microsoft’s affected-product list names only Enterprise Server 2016, but its FAQ says the same KB applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016, and customers running either version should install itSame as the 2016 row
SharePoint 2013The researcher says affected; Microsoft’s advisory does not list it, and this version gets no security updatesNone
SharePoint Online (cloud)Field Effect notes it is not listed as affectedNot applicable

SharePoint Server 2016 (standard) needs the update too: The FAQ in Microsoft’s advisory (MSRC CSAF) says the same KB number applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016, and customers running either version should install the security update.

Attack conditions (per Microsoft): the attacker must be logged in, but a low-privilege account is enough, with no admin rights needed; the attack works over the network; and no user interaction is required.

The no-login chain (researchers and agencies, not Microsoft): The Canadian Cyber Centre says that, chained with other SharePoint vulnerabilities, the flaw can give remote code execution without logging in on servers that permit anonymous access. According to Previdian and the researcher Khoa, this path needs both conditions: the site allows anonymous viewing, and a separate anonymous-delivery / authentication-bypass bug is unpatched. Khoa says that bug was fixed in a June 9 update and servers with it are not exposed to the no-login path. Its CVE ID is not known.

How it works

Microsoft classifies this as CWE-94 (code injection): SharePoint does not properly control input when it generates code, so a logged-in attacker who sends a specially crafted request can make the server run code of their choosing. The CVSS 3.1 score Microsoft (as CNA) gave in the CVE record (8.8, republished by NVD) rates the impact on confidentiality, integrity and availability all as High.

Our sources do not say which code is at fault. The researcher says the August 11 patch fixes the flaw and also turns the vulnerable function off by default. The following is a generic illustration of code injection, not SharePoint’s code:

The flawed approach (conceptual illustration):

Show code example(text)
template = content sent by the user
code = build template into code that gets compiled or parsed
run(code)          // user content has become a program on the server

The fixed approach (conceptual illustration):

Show code example(text)
accept only known elements from an allowlist
treat user content as data, never as code
turn unneeded dynamic features off by default

The classification changed. When Microsoft first published on August 11 it listed the impact as “spoofing”. On August 27 it changed the impact, title and FAQs to remote code execution, calling this an “informational change”. GitHub’s advisory database (unreviewed) still says spoofing and scores it CVSS 3.1 6.5 (confidentiality impact only); Microsoft, as CNA, scores it CVSS 3.1 8.8 in the CVE record (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with temporal metrics E:U/RL:O/RC:C); NVD only republishes this score as a Secondary source and has no score of its own. The difference comes from the old classification; this page uses 8.8. Microsoft’s overall severity rating is Important.

Timeline

DateEvent
2026-06-09Per the researcher, the separate authentication-bypass bug used in the no-login chain is fixed
2026-07-15Per the Canadian Cyber Centre, SharePoint 2016 and 2019 reach end of life
2026-08-11Microsoft publishes the advisory, CVE and security updates, listed as spoofing
2026-08-27Microsoft changes the impact, title and FAQs to remote code execution
2026-09-22The researcher publishes technical details and proof-of-concept code; The Hacker News reports no in-the-wild exploitation yet
2026-09-24Previdian’s honeypot captures exploitation requests
2026-09-25Microsoft says it has reliable evidence of attacks; CISA adds it to KEV; Previdian adds the web shell name
2026-09-28CISA’s remediation deadline for US federal agencies

Further reading

  • Exploitation status: Microsoft and the Canadian Cyber Centre both confirm real attacks, and CISA has listed it in KEV; CISA marks ransomware use as “Unknown”. Microsoft has not said when attacks began, how many organizations were hit, or who is behind them. The earliest third-party observation is September 24.
  • Zero-day or not: No source reports attacks before the August 11 patch. The reported attacks came about six weeks after patches and two days after technical details went public, so our analysis is that this does not look like a zero-day, though no source says so directly.
  • Attempt counts differ: Previdian’s own post says it captured 12 requests from a single source on September 24; The Hacker News, citing Previdian data, reports 16 attempts from IPs in the U.K. and Israel. Previdian also says it has not shown that the captured attempt would succeed on a real SharePoint installation.
  • Scoring differences: Microsoft (CNA) CVSS 3.1 is 8.8, republished by NVD; GitHub’s unreviewed entry is 6.5, matching the old spoofing classification.
  • Credit: Microsoft credits khoadha; news reports name him as Dinh Ho Anh Khoa of Viettel Cyber Security.
  • Related weakness type: CWE-94.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-11 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisoryMicrosoft SharePoint Server Remote Code Execution Vulnerability (CVE-2026-65660) — CSAF advisory · Microsoft Security Response Center, 2026-08-11 · accessed 2026-10-07
  2. CVE / NVD / OSVCVE-2026-65660 record · CVE Program, 2026-08-11 · accessed 2026-10-07
  3. CVE / NVD / OSVNVD - CVE-2026-65660 · NIST · accessed 2026-10-07
  4. OtherGitHub Advisory Database entry for CVE-2026-65660 (unreviewed) · GitHub · accessed 2026-10-07
  5. Patch / releaseAugust 2026 updates for Microsoft Office · Microsoft, 2026-08-11 · accessed 2026-10-07
    Microsoft's index of August 2026 Office updates; it lists the SharePoint updates KB5002893 (Subscription Edition), KB5002894 and KB5002896 (2019 and its language pack), and KB5002905 and KB5002906 (2016 and its language pack).
  6. VendorSharePoint updates · Microsoft Learn · accessed 2026-10-07
  7. AdvisoryAL26-023 – Vulnerability impacting Microsoft SharePoint Server (CVE-2026-65660) · Canadian Centre for Cyber Security · accessed 2026-10-07
  8. ResearchCVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts · Previdian · accessed 2026-10-07
  9. ResearchSharePoint vulnerability exploited · Field Effect · accessed 2026-10-07
  10. NewsSharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE · The Hacker News · accessed 2026-10-07
  11. NewsSharePoint RCE and MikroTik RouterOS flaws (CISA KEV) · The Hacker News · accessed 2026-10-07
  12. NewsMicrosoft SharePoint flaw CVE-2026-65660 now exploited in attacks · SecurityWeek · accessed 2026-10-07

Press brief

In one sentence

On August 11, 2026, Microsoft patched a flaw in self-hosted SharePoint Server that it first classified as "spoofing", then on August 27 reclassified as remote code execution. Anyone with a low-privilege account can run code on the server. After technical details and proof-of-concept code went public on September 22, Microsoft confirmed real attacks on September 25, and the US agency CISA added it to its Known Exploited Vulnerabilities catalog the same day.

Key facts

Severity
CVSS 3.1 8.8 (Microsoft as CNA; republished by NVD) cveawg.mitre.org
CVE published and patched
2026-08-11 cveawg.mitre.org
Reclassified from spoofing to RCE
2026-08-27 msrc.microsoft.com
Added to CISA KEV
2026-09-25 cveawg.mitre.org
Researcher
khoadha (Microsoft credit); named by news reports as Dinh Ho Anh Khoa of Viettel Cyber Security thehackernews.com

Confirmed

  • Microsoft confirms a code injection flaw that lets a logged-in, low-privilege attacker run code on SharePoint Server over the network.
  • Microsoft says that as of 2026-09-25 it had reliable evidence of attacks; the Canadian Cyber Centre also says it is aware of active exploitation.
  • CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-25.

Unconfirmed / disputed

  • The researcher says SharePoint 2013 is also affected; Microsoft's advisory does not list it.
  • Previdian honeypot counts differ: Previdian says 12 requests from a single source; The Hacker News reports 16 attempts from IPs in the U.K. and Israel.
  • Microsoft has not said when attacks began, how many organizations were hit, or who is behind them.
  • The CVE ID of the June authentication-bypass bug used in the no-login chain is not known.

Quotable line

A vulnerability's label can be changed overnight; an update you never installed stays uninstalled.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "SharePoint Server code injection: first listed as "spoofing", it actually lets a low-privilege user run code on the server". PlainCVE. https://plaincve.date/en/vulns/cve-2026-65660-sharepoint-server-code-injection-rce (accessed YYYY-MM-DD)
BibTeX
@misc{cve202665660sharepointservercodeinjectionrce2026,
  title  = {SharePoint Server code injection: first listed as "spoofing", it actually lets a low-privilege user run code on the server},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-65660-sharepoint-server-code-injection-rce},
  note   = {Updated 2026-10-11}
}