CVE-2026-66808

This vulnerability is like a “bad handshake” where SharePoint can be tricked into treating attacker-controlled data as something trustworthy. If someone has a basic user account, they can send the right kind of data to cause SharePoint to run attacker commands on the server.

In plain terms: it raises the risk that an attacker could get control of your SharePoint server, install harmful software, and disrupt your business or access documents.

This matters if your business runs Microsoft SharePoint Server (including SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) and it’s reachable in your normal configuration.

The risk is specific: the attacker must already have valid login credentials for a low-privilege account and must know how to craft the malicious data—there is no need for you to click anything.

This is RED because the bug allows remote code execution and is reachable in default configurations, meaning attackers don’t need special network access patterns. In addition, a known threat actor (Lazarus group) is associated with the activity and the fix is already available.

Act now to reduce the chance that a compromised or misused account could be used to take over your SharePoint server.