CVE-2026-66805

Think of SharePoint like a secure building that runs your business’s documents and lists. This flaw is like a door lock that can be tricked by someone who already has a valid key (a logged-in user) into believing harmful instructions are normal requests—then the attacker can run commands and tamper with or steal the data the app can access.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server on premises. The key requirement is that the attacker has valid login credentials with low privileges—so it’s most likely a risk in situations like a compromised account, a bad password, or overly broad user permissions.

Red means this is a high-priority fix: the vulnerability allows remote code execution, and the impact includes taking over the server and accessing/modifying application-accessible data. Even though no KEV entry and no clear, dated public “actively exploited” claim were provided in the sources, the combination of remote execution capability plus the need only for low-privilege authenticated access makes it urgent to patch.