Microsoft SharePoint CVE-2026-65660

Exploitation requires network access to a Microsoft SharePoint Server instance running an unpatched build of SharePoint 2016 Enterprise (below 16.0.5565.1001), SharePoint 2019 (below 16.0.10417.20198), or SharePoint Subscription Edition (below 16.0.19725.20522). The CVE description explicitly states the attacker must be 'authorized,' confirming that valid low-privileged SharePoint credentials are required (consistent with CVSS PR:L); unauthenticated exploitation is not possible. The SSVC assessment of Automatable: no indicates scripted mass exploitation without per-target interaction is unlikely, meaning the attacker cannot simply enumerate and mass-exploit exposed instances. Limiting factors include the mandatory authenticated access requirement, the absence of a publicly known exploit, and SSVC's technical impact rating of partial rather than total, suggesting the practical damage surface may be narrower than the CVSS full-triad impact implies.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) places this in the high-severity tier, with network exploitability at low authentication and full C/I/A impact. However, multiple independent signals substantially moderate the real-world urgency. EPSS is only 0.68% at the 49th percentile, indicating exploitation probability is near the median CVE rather than elevated. SSVC qualifies this as exploitation: none, automatable: no, and technical impact: partial - all diverging from the CVSS maximum-impact assessment and suggesting meaningful exploit friction. There is also a factual tension in the source data: the CVE description characterizes the impact as 'spoofing,' while the tags list 'RCE' and the CVSS C:H/I:H/A:H assumes full system compromise; SSVC's 'partial' technical impact rating aligns more closely with the spoofing characterization than with full RCE, and this discrepancy should be explicitly verified against the Microsoft MSRC advisory before triaging response priority. No KEV listing means confirmed active exploitation is absent. Taken together, this warrants prioritized patching within normal patch cycle windows rather than emergency out-of-band remediation for most organizations.

A low-privileged authenticated SharePoint user crafts a malicious input payload and submits it to a vulnerable SharePoint server endpoint over the network. The server's code-generation logic fails to properly sanitize or validate the input, causing injected code to execute in the server process context and enabling the attacker to spoof other user identities or server-side operations. No public exploit code has been identified at time of analysis, so exploitation currently requires independent development of a working exploit.