CVE-2026-65660

Vendor

Microsoft

Product

SharePoint

EPSS

1.00 (p100)

CISA KEV

added 25 Sep 2026, due 28 Sep 2026 (34d overdue)

Weakness

CWE-94

Exposure class

Collaboration, Edge / VPN / firewall

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 68
   KEV CISA KEV 25 Sep 2026

   Microsoft SharePoint Code Injection Vulnerability

   Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

   KEV · due 28 Sep 2026 (overdue) Fix available CVE-2026-65660 Microsoft
2. 65
   CISA alert CISA 25 Sep 2026

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability CVE-2026-67279 Mikrotik…

   Exploited CVE-2026-65660CVE-2026-67279 Microsoft MikroTik
3. 31
   Research Insikt Group 19d ago

   September 2026 CVE Landscape

   In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.

   EPSS 1.00 CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
4. 25
   Advisory MSRC 11 Aug 2026

   CVE-2026-65660 Microsoft SharePoint Server Spoofing Vulnerability

   As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.

   CVE-2026-65660 Microsoft