Microsoft has confirmed active exploitation of CVE-2026-65660, a code injection vulnerability in on-premises SharePoint Server that gives an authenticated attacker remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 24, 2026, giving federal civilian agencies until September 28 to patch or take affected systems offline.
The flaw's history is the real story here. Microsoft shipped a fix for it in the August 11, 2026 Patch Tuesday round, but described the bug at the time as a low-severity spoofing issue rated 6.5 on the CVSS scale. On September 11, without any accompanying advisory, Microsoft rewrote the entry: the flaw is authenticated remote code execution, and the National Vulnerability Database now scores it 8.8. Any organization that triaged the August update as routine, or deferred it because the listed severity looked minor, had already missed the real risk by the time attackers started exploiting it.
The bug sits in SharePoint's ToolPane component, which fails to escape double-quote characters in web-part markup. That lets an authenticated user register arbitrary .NET classes outside SharePoint's SafeControls allowlist, then trigger execution through XamlServices.Parse() deserialization, turning a low-privilege account into full code execution on the server. Affected products are on-premises SharePoint Enterprise Server 2016 (before build 16.0.5565.1001), SharePoint Server 2019 (before build 16.0.10417.20198), and SharePoint Server Subscription Edition (before build 16.0.19725.20522). SharePoint Online is not affected.
Microsoft's August 2026 cumulative updates already contain the fix, so any SharePoint Server administrator who hasn't installed them should treat this as urgent patching, not a backlog item. Where immediate patching isn't possible, Microsoft recommends enabling Antimalware Scan Interface integration for SharePoint web applications and setting AMSI Request Body Scan Mode to Full, which can catch exploitation attempts even on unpatched builds. Given confirmed in-the-wild activity, defenders should also review SharePoint access logs for anomalous ToolPane or web-part requests and unexpected process spawns originating from the SharePoint application pool.
