Date: September 27, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Security / Collaboration Systems / Code Injection & RCE
Tags: Microsoft SharePoint, CVE-2026-65660, Remote Code Execution, CISA KEV, Web Shells, IIS, Enterprise Security
Executive Summary
A severe vulnerability in on-premises Microsoft SharePoint Server that was originally categorized as a benign spoofing issue has escalated into an active enterprise security emergency. On September 25–27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-65660 to its Known Exploited Vulnerabilities (KEV) catalog following confirmed evidence of weaponization by threat actors in the wild.
First addressed by Microsoft during its August 2026 security release as a low-to-medium severity spoofing flaw, the tech giant formally amended its security advisory this week to reclassify CVE-2026-65660 as a high-severity Code Injection and Remote Code Execution (RCE) vulnerability with a CVSS v3.1 score of 8.8. The flaw impacts on-premises installations of Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
Threat actors are actively leveraging low-privileged domain credentials—frequently acquired through credential-stuffing or phishing—to inject arbitrary code directly into SharePoint server processes. Once code execution is established, adversaries deploy ASPX web shells, harvest IIS service account tokens, and establish persistent footholds deep within corporate internal networks. Because on-premises SharePoint servers frequently interface directly with Active Directory, Microsoft SQL database clusters, and sensitive document libraries, successful exploitation offers attackers immediate access to proprietary corporate knowledge bases.
Technical Deep-Dive: Deconstructing the SharePoint Code Injection Flaw
To understand how an authenticated user can bypass application sandboxing to achieve remote code execution, we analyze SharePoint’s server-side rendering pipeline and code execution pathways.
Phase
Actor / System
Action & Operational Context
1
Attacker
Authenticates with low-privilege domain credentials (e.g., standard employee).
2
Attacker -> SharePoint WFE
Submits crafted HTTP POST / RPC payload containing injected server-side code block into vulnerable SharePoint API endpoint.
3
SharePoint WFE
Input Validation Failure: Endpoint fails to sanitize serialized/embedded code and compiles/executes code in SharePoint worker process (w3wp.exe) context.
4
SharePoint WFE
Spawns Web Shell: Drops malicious .aspx payload into SharePoint virtual layout to gain a persistent backdoor.
5
Attacker <-> SharePoint WFE
Interacts with Web Shell via HTTP, executing system commands as WSS_WPG.
6
Attacker -> Internal Network
Siphons Farm Configuration Secrets, dumps SQL databases, and pivots to Active Directory / Backend SQL.
1. The Misclassification Trap: From Spoofing to RCE
When Microsoft initially documented CVE-2026-65660, the issue was described as a spoofing defect within SharePoint Server's web rendering components. In complex enterprise platforms like SharePoint, vulnerabilities that appear to be UI-layer spoofing or request manipulation can obscure deeper code evaluation flaws:
* Flawed Input Sanitization: The vulnerability occurs when SharePoint parses user-supplied data transmitted to specific collaborative page features or web part customization APIs.
* Dynamic Compilation & Execution: Rather than treating user input strictly as inert markup, SharePoint's internal processing routine passes the input through an unsanitized compilation or dynamic execution path.
* Security Reclassification: Threat intelligence telemetry from security firms including SecurityWeek and Previdian revealed that attackers were chaining this flaw to execute arbitrary .NET code within the SharePoint Internet Information Services (IIS) worker process (w3wp.exe), prompting Microsoft to officially reclassify the vulnerability as code injection leading to remote code execution.
2. Exploit Mechanics and Authentication Requirements
While CVE-2026-65660 requires authentication, the threshold for exploitation is remarkably low:
* Any Valid Domain User: The attacker does not require site collection administrator privileges or special farm management rights. Any authenticated user account with standard read/contribute access to a SharePoint site can reach the vulnerable endpoint.
* Credential Sourcing: In real-world enterprise breaches, attackers obtain standard domain credentials through credential harvesting, infostealers, or spray attacks against exposed single-sign-on (SSO) portals.
* Payload Execution: Once authenticated, the attacker dispatches an HTTP request with crafted properties that trigger code injection. The code executes under the security context of the SharePoint application pool identity (typically a high-privilege service account such as WSS_WPG or an account with broad local server rights).
3. Post-Exploitation: ASPX Web Shells and Farm Infiltration
Forensic investigations of in-the-wild exploitation have uncovered a standardized post-exploitation tradecraft:
1. Web Shell Implantation: Threat actors drop lightweight ASP.NET web shells into SharePoint application directories (e.g., within _layouts or custom virtual directories). These web shells provide resilient, unauthenticated command execution interfaces accessible over standard HTTPS.
2. Credential & Secret Extraction: Attackers use the compromised application pool identity to dump SharePoint farm configuration databases, decrypt stored database connection strings, and extract DPAPI-protected machine keys.
3. Lateral Movement: Armed with elevated SharePoint service credentials, adversaries query internal Microsoft SQL Server databases hosting enterprise document libraries, contracts, and financial statements, subsequently pivoting toward Domain Controllers.
Industry Impact & Enterprise Exposure
SharePoint remains the foundational collaboration backbone for Fortune 500 corporations, government entities, and defense contractors:
* On-Premises Concentration: While many organizations have migrated to SharePoint Online (Microsoft 365), high-security sectors—including defense, healthcare, government, and financial services—continue to maintain extensive on-premises SharePoint Server farms to comply with data sovereignty regulations.
* Critical KEV Binding Directive: CISA’s addition of CVE-2026-65660 to the Known Exploited Vulnerabilities catalog mandates that all federal civilian agencies apply official patches immediately. Non-governmental enterprises should treat this directive as an urgent warning.
* Ransomware Staging Ground: Because on-premises SharePoint servers possess extensive cross-network connectivity to corporate file servers and internal infrastructure, they serve as prime targets for double-extortion ransomware syndicates seeking maximum network disruption.
Defensive Hardening & Remediation Blueprint
Enterprise IT and cybersecurity teams operating on-premises SharePoint environments must take immediate remediation actions:
1. Apply Microsoft Security Updates Immediately (Primary Fix)
Install the updated security patches provided by Microsoft for all supported on-premises editions:
* Microsoft SharePoint Server Subscription Edition
* Microsoft SharePoint Server 2019
* Microsoft SharePoint Server 2016
Ensure that post-installation tasks (such as running the SharePoint Products Configuration Wizard - psconfig.exe) are fully completed across all servers in the farm to finalize database and schema updates.
2. Audit SharePoint IIS Virtual Directories for Web Shells
Execute automated and manual file integrity sweeps across all SharePoint Web Front-End (WFE) servers:
* Inspect physical directory paths, specifically:
* C:\Program Files\Common Files\microsoft shared\Web Server Extensions\*\TEMPLATE\LAYOUTS\
* C:\inetpub\wwwroot\wss\VirtualDirectories\
* Scan for newly created or anomalous .aspx, .ashx, .asmx, or .config files created within the last 60 days.
* Compare deployed binaries and scripts against baseline installation hashes.
3. Monitor IIS Worker Process (w3wp.exe) Anomalies
Configure Endpoint Detection and Response (EDR) rules to detect suspicious process creation events where w3wp.exe acts as the parent process:
* Alert on w3wp.exe launching command interpreters or administrative utilities:
* cmd.exe
* powershell.exe / pwsh.exe
* certutil.exe, bitsadmin.exe, whoami.exe, net.exe
* Monitor for unexpected outbound network connections initiated by w3wp.exe to external IP addresses.
4. Enforce Multi-Factor Authentication & Restrict Internal Exposure
* Ensure all accounts capable of authenticating to internal SharePoint servers are protected by phishing-resistant Multi-Factor Authentication (MFA).
* Restrict network access to SharePoint web interfaces using reverse proxy authentication and network micro-segmentation, preventing direct exposure to untrusted network segments.
________________
For technical vulnerability breakdowns, Microsoft enterprise security alerts, and threat intelligence reports, subscribe to Digital Spying.