Swiss SME Cyber Alert: Microsoft SharePoint Server – actively exploited flaw requires urgent review
Attackers are actively exploiting CVE-2026-65660 in Microsoft SharePoint Server.
The issue affects on-premises SharePoint Server 2016, 2019 and Subscription Edition. SharePoint Online in Microsoft 365 is not affected.
If your company operates its own SharePoint server, or has one managed by an IT provider, ask them to verify the patch level and check for signs of compromise now.
What happened?
CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalogue on 25 September 2026. The flaw allows an attacker who already has a low-privilege account to execute code on an affected SharePoint server without further user interaction. Microsoft released security updates on 11 August 2026.
Could my company be affected?
Yes, if you run SharePoint Server 2016, SharePoint Server 2019 or SharePoint Server Subscription Edition on your premises, in a data centre or through an IT provider. These systems are often used for document portals, intranets or partner access. Companies using only SharePoint Online in Microsoft 365 are not affected by this server vulnerability.
What should you do now?
Ask your IT provider to confirm whether an on-premises SharePoint server is in use and to verify the installed patch level across every server in the farm. If the 11 August 2026 security update, or a newer cumulative update, is missing, remediation should be prioritised. Internet-facing or late-patched systems should also be assessed for compromise.
How urgent is it?
High. Active exploitation has been confirmed. Affected on-premises SharePoint servers should be reviewed now rather than waiting for the next routine maintenance window.
Information for your IT provider
CVE-2026-65660: code injection / remote code execution, CVSS 8.8; a low-privilege authenticated account is sufficient.
Affected: SharePoint Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. SharePoint Online is not affected.
Install at least the Microsoft security updates released on 11 August 2026, or a newer cumulative update, on every farm server and verify successful installation.
August package reference builds: Subscription Edition 16.0.19725.20522 (KB5002893), SharePoint 2019 16.0.10417.20198 (KB5002894; language pack KB5002896), SharePoint 2016 16.0.5561.1001 (KB5002905; language pack KB5002906).
For internet-facing or late-patched systems, review SharePoint and IIS activity for suspicious behaviour and web shells.
