CVE-2026-65660 is an authenticated remote code execution (RCE) vulnerability in Microsoft SharePoint Server that allows a low-privileged user account—the kind that exists by default in most enterprise Microsoft 365 environments—to execute arbitrary code on the SharePoint host. When chained with a separate authentication bypass vulnerability disclosed alongside it, the exploitation requires no valid credentials at all, enabling unauthenticated RCE. This security flaw has been actively exploited by threat actors deploying web shells into SharePoint environments, establishing persistent remote access into internal networks. For Lebanese, Nigerian, UAE, and KSA organizations using SharePoint Enterprise Server as the backbone of internal operations, document management, and cross-team collaboration, this is a critical and active threat to the most densely used platform in their Microsoft environment.
SharePoint occupies a position in enterprise architecture that makes it a high-value target independent of any specific vulnerability. It stores sensitive data such as internal documents, project files, HR records, financial models, compliance documentation, and board materials. It integrates with Active Directory for authentication, with Exchange for email-linked collaboration, and with Azure AD for identity federation. A web shell planted on a SharePoint server does not just give an authorized attacker access to SharePoint content; it provides a command execution point inside the network from which they can reach every system that SharePoint integrates with.
SharePoint Server exposes several HTTP endpoints for administrative functions, site operations, and document processing. CVE-2026-65660 exists in how SharePoint handles certain authenticated requests to these endpoints: a low-privileged account—not an administrator, not a site owner, but a standard read-level member of a SharePoint site—can craft a request that triggers code injection flaw execution on the SharePoint server host. Official advisory coverage from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed CVE-2026-65660 in the Known Exploited Vulnerabilities catalog. It carries a CVSS score of 8.8, marking it as a high-severity software flaw under active exploitation.
The critical escalation is what that code execution enables. SharePoint runs as a high-privilege service account with read-write access to the SharePoint content database, the file system directories where site content is stored, and the web-accessible directories where SharePoint's web interface is served. An attacker who achieves code execution via this vulnerability can write a web shell—a small, persistent script—to a directory served by SharePoint's web interface. Once that web shell is in place, the attacker has persistent, credentialless command execution on the SharePoint host accessible via any HTTP client that can reach the server. The web shell survives patching: applying the CVE-2026-65660 patch after a web shell is already planted does not remove the web shell.
The authentication bypass chained with this vulnerability removes the requirement for even a low-privileged account. The combination means an attacker with no presence in the organization's Microsoft environment, no account, no credentials, no prior access, can reach a network-accessible SharePoint server and achieve code execution.
Lebanese banks, government ministries, and professional services firms have standardized on SharePoint as the primary internal collaboration and document management platform. The affected products here are typically on-premises deployments such as SharePoint Server 2016 and SharePoint Server 2019, and in some environments the SharePoint Server Subscription Edition as well. The content stored—the audit files, credit facility documentation, board resolutions, regulatory correspondence with the Banque du Liban, internal communications about sensitive transactions—is the most sensitive operational material in the organization. An attacker who plants a web shell on the SharePoint host does not need to search for valuable content. The content is already organized and indexed by SharePoint's own search infrastructure.
UAE enterprises with SharePoint deployments face an additional exposure from the platform's integration depth. SharePoint in larger UAE enterprise environments is typically connected to Azure AD for single sign-on, to Exchange Online or on-premises Exchange for email-linked collaboration, and to Power Platform for workflow automation. An attacker with command execution on the SharePoint host can reach the service accounts and stored credentials that maintain these integrations, turning a SharePoint compromise into a foothold across the entire Microsoft tenant.
A web shell planted on SharePoint is designed to blend into normal web traffic. Requests to the shell look like standard HTTP requests to SharePoint endpoints. The attacker interacts with it through normal web channels. SharePoint's own logging may not distinguish web shell access from legitimate SharePoint usage at the application layer. External SOC monitoring provides detection coverage across multiple signals that the SharePoint application layer does not generate:
Microsoft has released emergency patches for SharePoint Server 2019 and the Subscription Edition, with an update for SharePoint Server 2016 in development and expected shortly. Customers should apply updates immediately to mitigate this security flaw. If immediate patching is not possible, Microsoft recommends temporarily disconnecting the affected servers from the internet to prevent further damage.
To enhance protection, Microsoft recommends enabling the Antimalware Scan Interface (AMSI) on all SharePoint servers, which has been enabled by default since September 2023 but should be verified manually. Rotating ASP.NET machine keys after applying updates or enabling AMSI prevents previously stolen validation keys from being reused by malicious actors.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) requires government agencies to take action within 24 hours of patch availability for CVE-2026-65660. Organizations should monitor for anomalous processes in the IIS worker process and conduct forensic investigations if suspicious files such as 'spinstall0.aspx' are detected.
CVE-2026-65660 affects SharePoint Enterprise Server on-premises deployments. Microsoft 365 SharePoint Online is managed by Microsoft and patched centrally, so cloud-hosted SharePoint Online customers are not directly exposed to this vulnerability through their own infrastructure. However, organizations running hybrid SharePoint environments where on-premises SharePoint Server is connected to SharePoint Online for content synchronization should treat the on-premises component as the exposure point and prioritize its patching regardless of the cloud footprint.
SharePoint that is not internet-accessible is not exposed to external scanning and exploitation from the public internet. However, the exploitation requires any HTTP client that can reach SharePoint's web interface including internal workstations, VPN-connected remote users, and any authorized attacker who has achieved initial access through phishing, a compromised endpoint, or another perimeter vulnerability. Internal network placement reduces external scanning exposure but does not eliminate the risk once an attacker has achieved any internal foothold.
A retrospective assessment for CVE-2026-65660 exploitation should cover: review of IIS access logs on SharePoint servers for requests with payload patterns consistent with the exploitation sequence and other observed attacks; filesystem integrity check of SharePoint web application directories for .aspx or .ascx files not in the deployment baseline; review of outbound network connections from SharePoint servers against an approved connection inventory; and audit of Active Directory authentication events for queries originating from SharePoint service accounts outside expected operational patterns. Traditional login controls do not eliminate risk after successful exploitation if an attacker can reach the web interface from an internal workstation or VPN-connected device. If anonymous access is enabled on exposed SharePoint sites, it can further reduce the barriers to exploitation when chained with other flaws. If any check produces anomalous findings, treat the SharePoint host as compromised, isolate affected systems, and initiate incident response before applying the patch because web shells planted pre-patch survive the update. As part of validation, confirm AMSI integration is present, verify the antimalware scan interface is active, and document enabling AMSI if it is not. Review detections in Microsoft Defender and compare findings across related systems against the latest advisory.
As the best cybersecurity solution provider with MSSP certification in Lebanon, Nigeria, UAE, and KSA, SHELT offers 24/7 SOC services to help organizations detect, respond to, and mitigate threats like CVE-2026-65660. SHELT's expertise in proactive security, penetration testing, and compliance advisory ensures your SharePoint Enterprise Server and broader Microsoft environment remain secure against emerging threats.
.png)
© SHELT 2023 Privacy Policy | Terms & Conditions
.png){kind=small}
