SharePoint CVE-2026-65660: The "Moderate" Patch That Turned Into Remote Code Execution

If you run SharePoint Server on-premises, confirm the August 2026 security update is installed on every farm server, then hunt for exploitation. CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities catalog on September 25, 2026, with a federal due date of September 28 (WindowsForum). SharePoint Online is not affected. SharePoint Server 2013 receives no fix and should be isolated or retired.

This one deserves attention because of how it was originally labeled. When Microsoft patched it on August 11, it was rated a 6.5 spoofing issue, the kind of update that ends up in a normal monthly cycle. It is now tracked as code injection with an NVD score of 8.8, and attackers are using it in chains for remote code execution (Decryption Digest).

What the flaw is

CVE-2026-65660 is improper control of code generation (CWE-94) in SharePoint's ToolPane functionality. Reported exploitation chains it with an earlier ToolPane authentication bypass, fixed in the June 9 update, so that an attacker who can reach the server gets code executing inside the SharePoint worker process (WindowsForum). Canada's Canadian Centre for Cyber Security confirmed exploitation on September 24 (Decryption Digest).

The lesson from the ToolPane chains of 2025 applies again: once code runs on a SharePoint server, attackers go after the ASP.NET machine keys, which let them forge authentication tokens and keep access even after patching.

Fixed builds

• SharePoint Server 2016: 16.0.5565.1001 or later
• SharePoint Server 2019: 16.0.10417.20198 or later
• SharePoint Server Subscription Edition: 16.0.19725.20522 or later
• SharePoint Server 2013: no fix; out of support

Build numbers per WindowsForum's summary of Microsoft's guidance. Make sure the June 9 update is present as well, since the chain depends on both. After patching, run the SharePoint Products Configuration Wizard or PSConfig where required; a binary-only install leaves the farm in a mixed state.

What to hunt for

• POST requests to /_layouts/15/ToolPane.aspx in IIS logs, especially with unusual referrers or from external IPs.
• w3wp.exe spawning cmd.exe or powershell.exe. Your EDR should alert on this by default; confirm it does on SharePoint servers.
• New or modified .aspx files in the LAYOUTS directory that do not match a known deployment.
• Outbound connections from SharePoint servers to addresses that are not Microsoft, your proxy, or known partners.

Indicators summarized from Decryption Digest.

If you find anything, rotate the machine keys

Patching closes the door but does not evict anyone already inside. If any indicator turns up, rotate the ASP.NET machine keys, restart IIS on every farm server, review recently created accounts and service principals, and treat the farm as an incident response case. We recommend rotating machine keys on internet-facing farms even if the hunt comes back clean, because the cost is low and the downside of a stolen key is high.

Also on this week's list: MikroTik

CISA's KEV additions this week also included CVE-2026-67279, an SSH workflow flaw in MikroTik RouterOS. Fixed releases are 7.24.2, 7.23.4, and 6.49.21 (WindowsForum). Branch routers are easy to forget in a Windows-heavy patch process. Upgrade, restrict SSH to trusted addresses or a VPN, and look for unfamiliar scripts or users.

The process gap this exposes

Severity labels at release are a starting point, not a decision. A "moderate" spoofing bug on an internet-facing collaboration server should not wait for the next maintenance window, and anything that later lands in KEV needs a fast re-triage path. Our Exchange KEV write-up made the same point about on-premises Microsoft servers. If your patch management program prioritizes only by vendor score, add exposure and KEV status to the formula. Talk to us if you want help running the hunt.

Frequently asked questions

Is CVE-2026-65660 being actively exploited?

Yes. CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on September 25, 2026 with a federal due date of September 28, and Canada's Cyber Centre confirmed exploitation on September 24.

Does CVE-2026-65660 affect SharePoint Online?

No. It affects on-premises SharePoint Server. SharePoint Online in Microsoft 365 is not affected.

What are the fixed SharePoint builds for CVE-2026-65660?

SharePoint Server 2016 16.0.5565.1001, SharePoint Server 2019 16.0.10417.20198, and SharePoint Server Subscription Edition 16.0.19725.20522, or later.

Is there a fix for SharePoint Server 2013?

No. SharePoint Server 2013 is out of support and receives no fix. Isolate it from the internet and plan migration.

Why rotate SharePoint machine keys after patching?

Attackers who gain code execution on SharePoint typically steal ASP.NET machine keys, which let them forge authentication tokens and persist after the vulnerability is patched. Rotating the keys invalidates that access.