Cyber Centre warns SharePoint code injection flaw is being exploited

The Canadian Centre for Cyber Security warned on Sept. 24 that attackers are actively exploiting a code injection vulnerability in on-premises Microsoft SharePoint Server, and urged organizations to install fixes that Microsoft released six weeks earlier.

The flaw, CVE-2026-65660, lets an authenticated attacker run arbitrary code on a vulnerable SharePoint server. The Cyber Centre's alert AL26-023 says that when it is chained with other SharePoint bugs, it can give an attacker remote code execution without logging in on servers configured to allow anonymous access. Organizations that skipped earlier SharePoint updates face a higher risk, the agency said.

A late change in severity

Microsoft patched the bug on Aug. 11. Security firm Previdian reported that Microsoft first labelled it a spoofing issue with a CVSS score of 6.5, then reclassified it on Aug. 27 as remote code execution with a score of 8.8. Previdian warned that teams which deprioritized the August fix based on the original rating should reassess.

Previdian said its SharePoint honeypot recorded a two-stage exploitation attempt on Sept. 24 from a single IP address. The first request tried to switch off .NET deserialization type checks. The second carried an encrypted loader. The firm said the requests targeted gallery pages rather than the ToolPane endpoint abused in earlier SharePoint campaigns, and relied on a separate anonymous-access issue Microsoft fixed in June. In a Sept. 25 update, it reported that successful exploitation drops a web shell at /_layouts/15/sphealth.aspx.

CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on Sept. 25 with a three-day deadline for federal agencies.

Fixed versions

• SharePoint Enterprise Server 2016: 16.0.5565.1001
• SharePoint Server 2019: 16.0.10417.20198
• SharePoint Server Subscription Edition: 16.0.19725.20522

The Cyber Centre noted that SharePoint 2016 and 2019 reached end of life in July 2026 and urged organizations to move to a supported version.

What to do

• Apply the August 2026 and all earlier SharePoint security updates, then confirm the build numbers above.
• Remove direct internet exposure and anonymous access where possible, and restrict Central Administration.
• Enable AMSI integration with Request Body Scan Mode set to Full, as the Cyber Centre recommends.
• Hunt for unusual POST requests to AddGallery.aspx and designgallery.aspx, unexpected web part changes, access to IIS machine keys and new .aspx files in the layouts folder.
• Report suspicious activity to the Cyber Centre through My Cyber Portal or [email protected].