SharePoint CVE-2026-65660: three days to patch

SharePoint CVE-2026-65660 went from a patched August bug to an actively exploited one on September 25, and the federal deadline is September 28. Microsoft shipped the fix in the August 11 cycle. If you run SharePoint Server on-prem and nobody has applied a cumulative update since summer, you are inside the window that matters.

What actually happened

CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities catalog on September 25, alongside a MikroTik RouterOS flaw. The NVD record carries CISA's own SSVC assessment: exploitation active, technical impact total.

The bug is code injection (CWE-94) in SharePoint's ToolPane component. CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, low privileges required, no user interaction, and confidentiality, integrity and availability all rated High. "Low privileges" means any authenticated account on the site. That is a normal employee, a contractor, or one phished login.

Here is the part that will cost you time. The Hacker News reported that Microsoft's advisory page titles CVE-2026-65660 a spoofing vulnerability and scores it 6.5, while the CVE record Microsoft publishes to NVD describes an authorized attacker executing code over a network and scores it 8.8. Same vendor, same CVE, two different severities. The researcher credited is Dinh Ho Anh Khoa of Viettel Cyber Security, and exploit code is public.

The patched builds, straight from the NVD record: SharePoint Enterprise Server 2016 at 16.0.5565.1001 or later, SharePoint Server 2019 at 16.0.10417.20198 or later, Subscription Edition at 16.0.19725.20522 or later. SharePoint 2013 is out of support and is not getting a fix.

Why a vendor severity mismatch matters for your business

Your patch queue is probably sorted by the wrong number. If your process is "anything 7.0 and above gets expedited," a 6.5 on the vendor's advisory page sailed past you in August. The 8.8 lives in a record most people never open. One CVE, two scores, and the one your tooling reads is the lower one.

Go look at the build number, not the patch log. SharePoint cumulative updates get deferred more than almost anything else on-prem, usually because someone once had a farm break on one. Pull the current build from Central Administration and compare it to the three numbers above. The patch log tells you what someone intended; the build number tells you what is running.

Three days is CISA's number, not yours. The BOD 26-04 deadline binds federal agencies. It is not a suggestion aimed at you, but it is the best free signal available for "somebody is using this right now." When a CVE hits KEV, it jumps the queue regardless of what the vendor advisory called it in August.

Assume the authenticated account is already available. The privilege bar here is membership, not admin. If your SharePoint has external sharing turned on, guest accounts, or a service account whose password has not rotated since the farm was built, the attacker does not need to escalate to anything. Patch, then audit who actually holds site membership.

If your SharePoint is managed by an MSP, today's email is one line: what build are we on, and when does the August cumulative update land.

Sources: CISA KEV alert, September 25 2026, NVD CVE-2026-65660, The Hacker News.