Microsoft SharePoint Code Injection Vulnerability

A code injection vulnerability has been identified in Microsoft SharePoint, tracked as CVE-2026-65660. The vulnerability allows an authorized attacker to execute arbitrary code over a network. It has been listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which prioritizes security updates based on risk. Microsoft has published guidance through its Security Response Center. CISA has also published forensic triage requirements as part of BOD 26-04 implementation guidance. The vulnerability is rated High criticality. Organizations using Microsoft SharePoint are advised to apply available security updates promptly. The vulnerability is also tracked in the NVD database.