Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

Patch on-premises SharePoint: a code-execution flaw fixed in August is now being exploited

CISA added a Microsoft SharePoint Server flaw (CVE-2026-65660) to its exploited list on September 25. Microsoft fixed it in August. Here's which builds are safe and how to check yours.

If your office runs SharePoint Server on its own hardware (2016, 2019, or Subscription Edition), check its patch level today. CISA added CVE-2026-65660, a code injection flaw in SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog on September 25, 2026. Microsoft released the fix with the August 2026 security updates, so this is a patch you may have skipped or deferred, not a new one.

SharePoint Online in Microsoft 365 is not affected by this server-side patching. Only servers you maintain need action.

What’s affected

The flaw lets an authenticated attacker with low-level access send a specially crafted request to the server and run code on it. No user has to click anything. Microsoft rates it Important, with a CVSS score of 8.8. Microsoft’s August notice said it was not yet exploited; CISA’s listing means that has since changed.

A low-privilege account is enough, so a single phished or reused password can be the starting point. That matters on small networks where many staff have SharePoint access.

Check whether you’re exposed

On the SharePoint server, open Central Administration, then Upgrade and Migration, then Check product and patch installation status. Compare the build number shown with the table below. Any build lower than the one listed is vulnerable.

Product Fixed in build August 2026 update
SharePoint Server Subscription Edition 16.0.19725.20522 KB5002893
SharePoint Server 2019 16.0.10417.20198 KB5002894 and KB5002896
SharePoint Server 2016 16.0.5565.1001 KB5002905 and KB5002906

Microsoft says to install every update package offered for your product, because SharePoint patches are split into several files. The same updates apply to both SharePoint Server 2016 and SharePoint Enterprise Server 2016.

What to do

  1. Back up first. Take a fresh backup or VM snapshot of the SharePoint servers and content databases.
  2. Install the updates for your version from the Microsoft Download Center links in the Microsoft advisory, on every server in the farm.
  3. Finish the upgrade step. After installing SharePoint patches, run the SharePoint Products Configuration Wizard (or PSConfig) on each server so the databases are brought up to date. Microsoft’s patching guidance for SharePoint covers the order.
  4. Confirm the new build in Central Administration.

CISA’s entry marks this one as needing forensic review, not just patching. If your server was unpatched while reachable, have someone look for unexpected new files, accounts, or admin changes before assuming it’s clean. Treat a server that was exposed to the internet and unpatched as possibly compromised.

Reduce the risk going forward

  • Don’t publish SharePoint to the internet unless you truly need to. If staff need it from home, put it behind a VPN with multi-factor authentication.
  • Remove old accounts and require two-step sign-in where you can. See two-step sign-in.
  • Put SharePoint on the monthly patch list. It’s easy to forget because users rarely notice it. The September 2026 Windows exploited-flaws summary covers the operating system side.
  • Check support status. Look up your SharePoint version on Microsoft’s lifecycle pages and plan a move before support ends.

If you hold criminal justice or bank data on SharePoint, confirm your reporting and remediation obligations with your CJIS Systems Agency, examiner, or counsel.

Sources

All articles