CISA Adds Microsoft SharePoint Code Injection Flaw CVE-2026-65660 to KEV

CISA added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint, to its Known Exploited Vulnerabilities (KEV) catalog on September 25. Federal agencies have until September 28 to act.

The flaw lets an authorized attacker run code over a network. CISA describes it as a code injection vulnerability that could allow an authorized attacker to execute code over a network. Microsoft’s CVSS 3.1 score is 8.8 (High), with low privileges and no user interaction required. The weakness is CWE-94, improper control of generation of code.

The vulnerability itself is not new. NVD published the Microsoft-assigned record on August 11, 2026. The KEV catalog lists vulnerabilities CISA knows are being exploited in the wild, and CISA lists this flaw’s use in ransomware campaigns as unknown.

CISA marks the entry for forensic triage. The required action is to apply mitigations according to Microsoft’s instructions under Binding Operational Directive 26-04, and the entry is flagged for CISA’s Forensics Triage Requirements. Where mitigations are unavailable, CISA says to discontinue use of the product. Microsoft’s entry for the flaw is in its Security Update Guide.

CISA added a separate MikroTik RouterOS flaw, CVE-2026-67279, to the catalog the same day, with the same September 28 deadline.