Microsoft SharePoint Remote Code Execution via Code Injection
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An attacker with a basic user account, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Isolate SharePoint servers using network segmentation and restrict access to only necessary ports and services. Deploy a Web Application Firewall (WAF) to scrutinize and block suspicious requests targeting code injection vectors. Implement enhanced logging and monitoring for unusual process execution or file modifications on SharePoint servers, and enforce strict least privilege principles for all SharePoint users and service accounts.
Apply the official security patch released by Microsoft for CVE-2026-65660 immediately upon availability. Ensure all affected Microsoft Office SharePoint installations are upgraded to a version that incorporates the permanent fix. Establish a routine patch management process to ensure all future security updates for SharePoint are applied promptly.
An authorized attacker can exploit this code injection vulnerability to execute arbitrary code remotely on the SharePoint server. This can lead to full compromise of the SharePoint environment, enabling data theft, service disruption, and potential lateral movement into other internal systems, posing significant business and compliance risks.
Other CVEs affecting sharepoint server
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Microsoft SharePoint Server Elevation of Privilege Vulnerability
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.