Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<div>
<div>
<div><p><strong>Number:</strong> AL26-023<br /><strong>Date:</strong> September 24, 2026</p>
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation of a vulnerability affecting Microsoft SharePoint ServerFootnote 1. In response to the Microsoft security advisory, released on August 11, 2026Footnote 2, the Cyber Centre issued AV26-804 Update 3Footnote 3 on September 24, 2026.
Tracked as CVE-2026-65660Footnote 4, this vulnerability is an Improper Control of Generation of Code ('Code Injection') (CWE-94)Footnote 5 vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an authenticated attacker to execute arbitrary code on vulnerable SharePoint servers.
Chained with other SharePoint vulnerabilities, this vulnerability can achieve pre-authentication remote code execution on SharePoint servers configured to permit anonymous access. Organizations that have not fully applied prior SharePoint security updates may therefore face an elevated risk of compromise.
Suggested actions
The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version:
| Affected products | Affected versions | Fixed Versions |
|---|---|---|
| Microsoft SharePoint Enterprise Server 2016 | All versions prior to 16.0.5565.1001 | Version 16.0.5565.1001 |
| Microsoft SharePoint Server 2019 | All Versions prior to 16.0.10417.20198 | Version 16.0.10417.20198 |
| Microsoft SharePoint Server Subscription Edition | All versions prior to 16.0.19725.20522 | Version 16.0.19725.20522 |
Important note: Microsoft SharePoint Enterprise Server 2016Footnote 6 and Server 2019Footnote 7 are end of life as of July 15, 2026. Organizations are urged to migrate to a supported version.
The Cyber Centre also recommends organizations to:
- Identify all on-premises SharePoint Server instances, particularly those exposed to the Internet, and ensure they are running supported versions of Microsoft SharePoint Server.
- Apply the latest Microsoft security updates to all affected SharePoint Server deployments, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
- Reduce the attack surface by restricting or eliminating direct internet exposure of SharePoint servers where possible, limiting access to SharePoint Central Administration and other management interfaces.
- Strengthen access controls by reviewing SharePoint environments for unnecessary or inactive accounts, removing unused accounts, and enforcing multi-factor authentication (MFA) for administrators and other privileged users.
- Harden SharePoint deployments by enabling Antimalware Scan Interface (AMSI) integration for SharePoint web applications and configuring AMSI Request Body Scan Mode to Full Mode where operationally feasible.
- Monitor for indicators of compromise and exploitation activity, including:
- unusual administrative activity or suspicious authenticated access attempts
- unexpected web part modifications or unauthorized configuration changes
- unauthorized authentication attempts and privilege escalation activity
- suspicious access to IIS machine keys
- evidence of deserialization attacks, web shell deployment, or malicious process execution
- unusual requests targeting SharePoint services
- Microsoft Defender or AMSI detections related to SharePoint exploitation activity
- Conduct ongoing log and security monitoring of SharePoint, IIS, endpoint security, and authentication logs to detect and investigate suspicious activity.
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topicsFootnote 8:
- patch operating systems and applications
- harden operating systems and applications
- isolate web-facing applications
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email [email protected].
References
- Footnote 1
-
CVE-2026-65660 - Previdian observes two stage SharePoint exploitation attempts
<p><a rel="noreferrer" target="_blank">Return to footnote1 referrer</a></p> </dd> <dt>Footnote 2</dt> <dd> <p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660" rel="noreferrer" target="_blank">Microsoft SharePoint Server Remote Code Execution Vulnerability</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote2 referrer</a></p> </dd> <dt>Footnote 3</dt> <dd> <p><a rel="noreferrer" target="_blank">Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 3</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote3 referrer</a></p> </dd> <dt>Footnote 4</dt> <dd> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-65660" rel="noreferrer" target="_blank">CVE-2026-65660</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote4 referrer</a></p> </dd> <dt>Footnote 5</dt> <dd> <p><a href="https://cwe.mitre.org/data/definitions/94.html" rel="noreferrer" target="_blank">CWE-94: Improper Control of Generation of Code ('Code Injection')</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote5 referrer</a></p> </dd> <dt>Footnote 6</dt> <dd> <p><a href="https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2016" rel="noreferrer" target="_blank">SharePoint Server 2016 - Microsoft Lifecycle</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote6 referrer</a></p> </dd> <dt>Footnote 7</dt> <dd> <p><a href="https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2019" rel="noreferrer" target="_blank">SharePoint Server 2019 - Microsoft Lifecycle</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote7 referrer</a></p> </dd> <dt>Footnote 8</dt> <dd> <p><a rel="noreferrer" target="_blank">Top 10 IT security actions to protect Internet connected networks and information (ITSM.10.089)</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote8 referrer</a></p> </dd>
</div>
Article Link: AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660 - Canadian Centre for Cyber Security