Our takeCISA added CVE-2026-65660 (SharePoint code injection, CVSS 8.8) to KEV: it's being exploited in the wild. Patch immediately if you self-host SharePoint (some enterprises); most small teams use the hosted version and can ignore this one.Security Resilience desk
Sources (7)
- cccs · cccs
- cisa_kev · cisa_kev
- hackernews · hackernews
- msft_security · msft_security
- msft_security · msft_security
- msft_security · msft_security
- helpnet · helpnet
What this means for you — Security leader:Patch all on-premises SharePoint Servers immediately; CISA has listed CVE-2026-65660 in KEV confirming active exploitation.
What this means for you — Lean IT orgs:If you self-host Microsoft SharePoint Server, apply the Microsoft patch right away. Most small teams use SharePoint Online instead and can ignore this.
What this means for you — MSP:Confirm which clients run on-premises SharePoint Server and schedule the CVE-2026-65660 patch urgently; hosted M365 tenants are unaffected.
What this means for you — Researcher:CISA added CVE-2026-65660 (SharePoint code injection, CVSS 8.8) to KEV citing confirmed in-the-wild exploitation.