CVE-2026-65663

This bug lets a user who can already authenticate to your SharePoint system send specially crafted content that SharePoint processes incorrectly, which can allow an attacker to run commands on the server from across the network. Think of it like someone slipping a harmful “code” into a package that the building staff opens and executes—without any human clicking on anything.

This matters if your business runs Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The issue requires an attacker to have valid authorization credentials (so it’s most relevant if those accounts can be abused, stolen, or are provided to people/partners you don’t fully trust). The risk is also dependent on whether the vulnerable functionality is reachable in your setup, which isn’t confirmed in the provided details.

This is urgent because the outcome is Remote Code Execution (attackers can run malicious code on the SharePoint server), and the vulnerability can be triggered over the network without any user interaction. Also, this has fresh security attention tied to a known threat actor (Lazarus group), so you should treat it as a priority patch rather than a “wait and see.”