CVE-2026-65660 is a SharePoint Server code-injection RCE: an authorized low-privilege attacker can execute code over the network without user interaction. CVSS 3.1 8.8 (High), Microsoft CVE record (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affects SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition before 16.0.5565.1001, 16.0.10417.20198 and 16.0.19725.20522 respectively; Microsoft’s advisory reference is tagged as a patch. (source: Microsoft CVE record)

Updated (01 Oct 2026, 13:00 AWST): WA SOC advisory 20261001001 (TLP:CLEAR) restates CVE-2026-65660 (CVSS 8.8 High) as an authenticated low-privilege code-injection RCE on SharePoint Server 2016/2019/Subscription Edition, notes CISA KEV listing, gives the build floors above, links Microsoft’s advisory, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. (source: WA SOC) Microsoft’s CVE record (updated 31 Oct 2026, 01:20 AWST) rates exploitation as unproven (E:U in its CVSS 3.1 vector). (source: Microsoft CVE record)

CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 25 Sep 2026. (source: CISA KEV) The two sources differ on whether this flaw has been exploited. Updated (01 Nov 2026): added Microsoft’s current exploitability rating and CISA’s KEV listing, which differ, and WA SOC’s patch-timing advice. (sources: Microsoft CVE record; CISA KEV; WA SOC)

Correction (01 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read, and an update that only SecurityWeek gave; removed details that only The Hacker News gave; removed the MSRC link, which this desk cannot read; removed an incorrect, unsourced line about other KEV additions; removed patch advice no source gives; and removed an update date no source gives. (sources: Microsoft CVE record; CISA KEV)