SharePoint’s federal clock runs out today — confirm the August builds

By George Bailey   Published: 09/28/26   Updated: 10/12/26   4 min read
Cybersecurity

CISA put a SharePoint code-injection bug on the federal clock with a due date of today, Monday, September 28. Microsoft has already said it has reliable evidence of observed attacks. Any farm that missed the August updates goes to the top of the list.

CISA’s SharePoint deadline is today, and Microsoft has already seen attacks.

Microsoft confirms attacks on CVE-2026-65660

CVE-2026-65660 is a code-injection flaw in Microsoft SharePoint Server that lets an authenticated attacker with low privileges execute code over the network (CWE-94). Microsoft shipped the fix in the August 11, 2026 Patch Tuesday updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

On September 25, Microsoft revised the advisory to state it had reliable evidence of observed attacks. The same day, CISA added the CVE to the Known Exploited Vulnerabilities catalog with a remediation due date of September 28 and forensic-triage expectations under BOD 26-04. Early-warning sensors (Previdian) reported exploitation attempts on September 24, including webshell creation attempts the next day. Researchers note attackers can chain the bug with a separate anonymous ToolPane / delivery path (fixed in an earlier update) to reach unauthenticated targets on farms that never took those prior patches.

A webshell on the farm reaches files and identity

SharePoint holds the documents, sites and service accounts people use every day. A webshell on the farm gives an attacker those files, a route into the rest of Microsoft 365 or on-prem identity, and persistence that survives a reboot. The federal due date is today. Private-sector teams should work to the same date, especially if the farm is Internet-facing or still on end-of-life 2016/2019 builds.

Microsoft’s early classification leaned toward “spoofing,” so an old ticket may still list it as moderate. Check the August build numbers on disk instead.

Confirm August builds, then hunt for webshells

Forward this

If you own on-prem SharePoint: verify the August 2026 security updates are installed on every farm today (build numbers above). CISA’s deadline is Monday September 28 and Microsoft has confirmed observed attacks. If a farm was Internet-facing and behind on patches, treat it as a possible compromise. Check for webshells and rotate the service accounts before you close the ticket.

Details

Hunt / verify

SharePoint farms to Aug 2026 builds today (16.0.5565.1001 / 16.0.10417.20198 / 16.0.19725.20522); KEV due Mon Sep 28; hunt ToolPane POSTs + webshells on anything that was late.

Sources

Related: see every Microsoft vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].