CVE-2026-65663

This bug lets a user who can already authenticate to your SharePoint system send specially crafted content that SharePoint processes incorrectly, which can allow an attacker to run commands on the server from across the network. Think of it like someone slipping a harmful “code” into a package that the building staff opens and executes—without any human clicking on anything.

This matters if your business runs Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The issue requires an attacker to have valid authorization credentials (so it’s most relevant if those accounts can be abused, stolen, or are provided to people/partners you don’t fully trust). The risk is also dependent on whether the vulnerable functionality is reachable in your setup, which isn’t confirmed in the provided details.

This is urgent because the outcome is Remote Code Execution (attackers can run malicious code on the SharePoint server), and the vulnerability can be triggered over the network without any user interaction. Also, this has fresh security attention tied to a known threat actor (Lazarus group), so you should treat it as a priority patch rather than a “wait and see.”

1. Confirm exposure (what to check)

   • Identify your SharePoint Server edition: SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition.
   • Record the exact build/version number installed.
   • If your environment runs multiple farms/servers, check each one.

2. Determine whether you are on a vulnerable build

   • Compare your build against Microsoft’s fixed builds:
     • SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
     • SharePoint Server 2019: fixed in 16.0.10417.20198
     • SharePoint Server Subscription Edition (and the “sharepoint server” listing): fixed in 16.0.19725.20522
   • If your build is earlier than the fixed one for your edition, you should assume you are exposed.

3. Patch (primary remediation)

   • Apply Microsoft’s update for CVE-2026-65663 from the MSRC update guidance.
   • Plan for normal SharePoint update considerations (maintenance window, farm service coordination, and post-update verification), especially if you run a multi-server farm.

4. If you can’t patch immediately (temporary risk reduction)

   • Reduce the chance that an attacker could use stolen/abused credentials against SharePoint by limiting which accounts can authenticate to SharePoint.
   • Review access for external users/partners and remove unnecessary permissions.
   • If SharePoint is reachable from the public internet, ensure strong authentication controls are in place and review any recent credential compromise signals.

5. What to monitor after patching

   • Verify SharePoint build/version matches the fixed build.
   • Review SharePoint/server logs around the time of the patch for unusual authentication attempts or abnormal activity.

6. KEV / exploitation notes

   • This CVE is not listed in CISA KEV based on the provided findings.
   • No specific in-the-wild incidents for CVE-2026-65663 were found in the provided reporting; however, because the impact is Remote Code Execution and the vulnerability has high security attention, patching remains necessary.

CVE-2026-65663 is a Microsoft SharePoint Server Remote Code Execution vulnerability (CWE-502, deserialization of untrusted data). The mechanism described is that incorrectly processed specially crafted network data can lead an attacker—who has valid authorization credentials—to execute arbitrary code on the remote SharePoint server without any user interaction.

Exploitation status in provided findings:

• CISA KEV: not listed.
• Public exploit code: none on record.
• In-the-wild reporting: no clear dated claims or incidents for this specific CVE in the provided news; another CVE may have been exploited in the articles, but not attributed to CVE-2026-65663.

Patch availability:

• Fixed versions are provided per edition:
  • SharePoint Enterprise Server 2016 → fixed in 16.0.5565.1001
  • SharePoint Server 2019 → fixed in 16.0.10417.20198
  • SharePoint Server Subscription Edition / sharepoint server → fixed in 16.0.19725.20522

Note on likelihood:

• EPSS is given as a prediction (trend flat), but this public likelihood metric should not be treated as proof of exploitation. The decisive factor here is the Remote Code Execution capability plus the press/security attention noted for Lazarus group.