CVE-2026-66805

Think of SharePoint like a secure building that runs your business’s documents and lists. This flaw is like a door lock that can be tricked by someone who already has a valid key (a logged-in user) into believing harmful instructions are normal requests—then the attacker can run commands and tamper with or steal the data the app can access.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server on premises. The key requirement is that the attacker has valid login credentials with low privileges—so it’s most likely a risk in situations like a compromised account, a bad password, or overly broad user permissions.

Red means this is a high-priority fix: the vulnerability allows remote code execution, and the impact includes taking over the server and accessing/modifying application-accessible data. Even though no KEV entry and no clear, dated public “actively exploited” claim were provided in the sources, the combination of remote execution capability plus the need only for low-privilege authenticated access makes it urgent to patch.

1. Confirm exposure (what to check)

• Identify which SharePoint you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server.
• Get the exact SharePoint build number from your farm (per your normal admin tooling/runbook).
• Determine whether your build is older than the vendor fixed builds:
  • 2016 should be updated to 16.0.5565.1001
  • 2019 should be updated to 16.0.10417.20198
  • Subscription Edition (and sharepoint server) should be updated to 16.0.19725.20522

2. Apply the fix

• Use the Microsoft MSRC update guide for CVE-2026-66805 and install the update(s) that correspond to your SharePoint version.
• Follow your standard maintenance process (service restart expectations, pre-checks, backups/snapshots as your org requires).

3. Verify

• Re-check the SharePoint farm/build number to confirm it now matches the fixed version for your edition.
• Validate SharePoint application health (basic site access, search functionality, and any critical workflows) to ensure the patch didn’t break core services.

4. If patching must be delayed

• Reduce risk immediately by limiting who can authenticate to SharePoint and tightening account controls, since exploitation requires a valid low-privilege account.
• Review recent access for unusual login patterns or privilege changes (especially if any account was recently compromised).
• Plan to patch at the earliest available window, because this flaw enables command execution when an authenticated attacker can reach the vulnerable processing path.

5. What to monitor after updating

• Look for suspicious authentication attempts (including failed logins and abnormal successes).
• Monitor SharePoint and server logs for unusual behavior consistent with attempted exploitation (unexpected processes/command execution patterns) and for any configuration or permission changes by users.

CVE-2026-66805 is a Remote Code Execution vulnerability in Microsoft SharePoint Server (CWE-502). The mechanism described in the findings is that a verified/authenticated low-privilege user can send specially crafted data that the server mistakenly processes as instructions, enabling arbitrary command execution; impact includes stealing or modifying all data accessible by the application.

Exposure/triggering

• Attack vector is remote.
• Authentication is required, specifically low-privilege (a standard user account is sufficient).
• No user interaction is required.
• Reachability in default config is not stated in the provided findings.

Exploitation status signals

• KEV: not listed in CISA KEV (per provided findings).
• Public exploit code: none on record in provided findings.
• No clear dated press claim of active exploitation was included in the provided sources.

Patch information (fixed builds)

• SharePoint Enterprise Server 2016 fixed in 16.0.5565.1001.
• SharePoint Server 2019 fixed in 16.0.10417.20198.
• SharePoint Server Subscription Edition (and sharepoint server) fixed in 16.0.19725.20522.

Actor/attention

• Provided findings indicate actor “Lazarus group” associated with new patch attention, suggesting heightened threat interest, even though the sources did not document CVE-2026-66805 specifically being exploited in the provided articles.

EPSS

• A prediction is present (trend: flat), but per instructions it should not drive the public urgency decision when exploitation/KEV claims are absent here; treat it as planning context only.