CVE-2026-65665

Think of SharePoint like your business’s document hub. This vulnerability is a bug where SharePoint can accidentally “trust” unsafe input it receives, and that mistake can let an attacker make the server run attacker-controlled code. If exploited, it can lead to a complete compromise of your SharePoint server and the data it holds.

This matters if you run Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or “sharepoint server” and users can access it. It’s mainly a risk when an attacker can get an authenticated account and reach the SharePoint system over the network (the default configuration is reachable). The main gate is attacker access: it requires an authenticated attacker.

This is RED because the flaw allows remote code execution and is reachable in default configuration. Even though exploitation details aren’t clearly dated in the news and no public exploit code is on record, the activity tracked by the patch/actor reporting indicates active attention on this issue, so you should patch immediately on your next maintenance window—ideally as soon as possible.