SharePoint’s federal clock runs out today — confirm the August builds

CISA put a SharePoint code-injection bug on the federal clock with a due date of Monday, September 28 — today. Microsoft already said it has reliable evidence of observed attacks. If your farm missed the August updates, you are not debating priority anymore.

Monday’s SharePoint deadline is not a reminder. It is the day the calendar ran out.

What happened

CVE-2026-65660 is a code-injection flaw in Microsoft SharePoint Server that lets an authenticated attacker with low privileges execute code over the network (CWE-94). Microsoft shipped the fix in the August 11, 2026 Patch Tuesday updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

On September 25, Microsoft revised the advisory to state it had reliable evidence of observed attacks. The same day, CISA added the CVE to the Known Exploited Vulnerabilities catalog with a remediation due date of September 28 and forensic-triage expectations under BOD 26-04. Early-warning sensors (Previdian) reported exploitation attempts on September 24, including webshell creation attempts the next day. Researchers note attackers can chain the bug with a separate anonymous ToolPane / delivery path (fixed in an earlier update) to reach unauthenticated targets on farms that never took those prior patches.

Why it matters

SharePoint holds the documents, sites, and service accounts people actually use. A webshell on the farm is access to files, lateral movement into the rest of Microsoft 365 / on-prem identity, and a quiet persistence point that survives a reboot. The federal due date is today — private sector shops should treat that as the same Monday morning priority, especially if the farm is Internet-facing or still on end-of-life 2016/2019 builds.

Microsoft originally undersold the issue (early classifications leaned “spoofing”). Do not trust an old ticket that marked it moderate — confirm the August build numbers on disk.

What to do first

Confirm every SharePoint Server is at or above: 2016 → 16.0.5565.1001, 2019 → 16.0.10417.20198, Subscription Edition → 16.0.19725.20522.
If you are still on 2016 or 2019: those SKUs hit end of life on July 15, 2026 — patch today, then plan the migration to a supported version.
Before patching Internet-facing farms, preserve IIS/SharePoint logs and take a forensic snapshot if exploitation is plausible.
Hunt for POST activity to ToolPane / design-gallery endpoints (including AddGallery.aspx / designgallery.aspx with edit modes) and for unexpected ASPX / in-memory webshells.
Rotate farm / service account credentials if the server sat unpatched after mid-September technical detail disclosure.
Block anonymous access to management surfaces you do not need; verify prior SharePoint security updates are also present so the delivery half of the chain is closed.

Forward this

If you own on-prem SharePoint: verify the August 2026 security updates are installed on every farm today (build numbers above). CISA’s deadline is Monday September 28 and Microsoft has confirmed observed attacks. If a farm was Internet-facing and behind on patches, treat it as a possible compromise — check for webshells and rotate the service accounts before you call it done.

Details

CVE: CVE-2026-65660 — code injection (CWE-94) → authenticated RCE; often chained toward unauthenticated impact on under-patched farms
Product: SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition
Fixed builds: 16.0.5565.1001 (2016), 16.0.10417.20198 (2019), 16.0.19725.20522 (Subscription Edition)
Vendor fix date: August 11, 2026 (Patch Tuesday)
KEV: added 2026-09-25; federal due 2026-09-28; forensic triage per BOD 26-04
Reporter: Viettel Cyber Security (Dinh Ho Anh Khoa) per public write-ups

Hunt / verify

Central Admin / PowerShell: confirm build ≥ fixed versions above on every server in the farm.
IIS logs: POSTs to ToolPane / gallery endpoints around Sep 24–28; unusual w3wp.exe child processes.
File integrity on LAYOUTS / content directories for unexpected ASPX and web.config changes.
Review recent farm admin / service account password changes and OAuth app principals.

Slack paste: SharePoint farms to Aug 2026 builds today (16.0.5565.1001 / 16.0.10417.20198 / 16.0.19725.20522); KEV due Mon Sep 28; hunt ToolPane POSTs + webshells on anything that was late.

Sources

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.