Active Exploitation of Code Injection Vulnerability in Microsoft SharePoint Server

The Canadian Centre for Cyber Security has confirmed active exploitation of CVE-2026-65660, a code injection vulnerability (CWE-94) affecting Microsoft SharePoint Server. The flaw permits an authenticated attacker to achieve arbitrary code execution on vulnerable instances. Crucially, when chained with other SharePoint vulnerabilities, attackers can reach pre-authentication remote code execution (RCE) on servers that allow anonymous access. This poses a severe risk to organizations running legacy or unpatched SharePoint deployments. Microsoft SharePoint Enterprise Server 2016 and Server 2019 reached end-of-life on July 15, 2026, and remain highly susceptible. Defenders must prioritize upgrading to the specified fixed versions to remediate the vulnerability and mitigate the risk of ongoing exploitation.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Microsoft SharePoint instances.
2. If anonymous access is enabled, the attacker chains existing auxiliary vulnerabilities to bypass initial authentication.
3. Attacker targets the specific code injection vector defined by CVE-2026-65660.
4. The malicious request triggers the underlying vulnerability, allowing for code execution within the SharePoint application context.
5. Attacker executes arbitrary commands, potentially deploying a web shell to maintain persistence (e.g., via T1505.003).
6. Attacker leverages the elevated application context to perform further privilege escalation or move laterally within the server environment.
7. Attacker achieves the final objective, which may include data exfiltration or internal network reconnaissance.

Impact

Successful exploitation allows attackers to gain full code execution on affected SharePoint servers. This can lead to total system compromise, unauthorized access to sensitive internal data, and the establishment of persistent backdoors within the organization's network. Given that many SharePoint instances store critical business and enterprise data, the impact of a successful breach is significant. Organizations running EOL versions (2016 and 2019) are at a particularly elevated risk, as they no longer receive standard support and may lack defense-in-depth protections.

Recommendation

Prioritize the immediate upgrade of all SharePoint instances to the fixed versions listed below. Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications and set the scan mode to 'Full' to improve detection of malicious payloads. Restrict access to management interfaces like SharePoint Central Administration and ensure all internet-facing instances are shielded from unnecessary exposure. Monitor IIS and SharePoint logs for anomalous administrative behavior, unauthorized web part modifications, and unexpected deserialization activity that may signal exploitation.