24 September 2026
Reference: CVE-2026-65660
1. What is being reported?
Researchers have identified a flaw in Microsoft SharePoint that was initially thought to be a minor issue but is now confirmed to allow attackers who have access to the system to execute malicious code remotely. This means someone with certain permissions could take control of the system without needing physical access.
2. What this means in plain English
If your organisation uses SharePoint, this vulnerability could let an attacker run harmful programs on your servers, potentially stealing data or causing damage. It is especially risky if attackers can gain access through compromised accounts or weak passwords.
3. Could this affect a small business?
Small businesses and charities using Microsoft SharePoint for collaboration or document management could be affected, especially if their SharePoint systems are accessible over the internet or have multiple users with editing rights. Organisations not using SharePoint or only using cloud-based versions managed by Microsoft may be less at risk but should still check with their provider.
4. What to do now
- Contact your IT provider or software supplier immediately to check if your SharePoint system is affected and to apply any available security updates or patches.
- Review user access permissions in SharePoint to ensure only trusted individuals have editing or administrative rights.
- Monitor your SharePoint environment for unusual activity or signs of compromise.
- Consider temporarily restricting external access to SharePoint until the vulnerability is addressed.
5. Ask your IT provider
Can you confirm if our SharePoint system is affected by CVE-2026-65660 and what steps are being taken to protect us from this remote code execution vulnerability?
6. Bottom line
If you use SharePoint, act quickly to secure your system against this serious vulnerability to protect your data and operations.
Information based on CISA KEV and reputable security reporting.