This article was written with the help of AI. We used an AI assistant to draft it, then checked every CVE and date against CISA's catalog and Microsoft's advisories. Sources are linked throughout.
SharePoint Server has been one of the most exploited Microsoft products of 2026. CISA's Known Exploited Vulnerabilities catalog, its list of flaws attackers are actually using, gained eight SharePoint entries between March and September. The latest, CVE-2026-65660, was added on September 25.
A note on timing: you may have seen claims of new SharePoint additions in late October 2026. As of November 13, CISA's catalog shows none after September 25. We stick to what the catalog shows.
The 2026 List
SharePoint flaws CISA added to the catalog in 2026, newest first:
- CVE-2026-65660: Code injection, added September 25, 2026
- CVE-2026-55040: Weak authentication, added August 18, 2026
- CVE-2026-50522: Deserialization of untrusted data, added July 22, 2026
- CVE-2026-58644: Deserialization of untrusted data, added July 16, 2026
- CVE-2026-56164: Missing authentication for critical function, added July 14, 2026
- CVE-2026-45659: Deserialization of untrusted data, added July 1, 2026
- CVE-2026-32201: Improper input validation, added April 14, 2026
- CVE-2026-20963: Deserialization of untrusted data, added March 18, 2026
Microsoft's advisories give more detail on several. CVE-2026-58644 and CVE-2026-50522 are remote code execution flaws scored 9.8 out of 10. CVE-2026-55040 is a security feature bypass scored 9.1. The newest, CVE-2026-65660, lets an attacker with low-level access to the server run code on it with a crafted request and no user interaction.
Who Is Affected
Microsoft's advisories for these flaws list the on-premises editions: SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016. If your files live in SharePoint or OneDrive inside Microsoft 365, Microsoft patches that for you.
Not sure which you have? If your SharePoint address ends in sharepoint.com, it is SharePoint Online. If it is a server in your office or data center, or an address on your own domain, it is probably SharePoint Server.
If You Run SharePoint Server
1. Patch to the latest security update
Install every update Microsoft lists for your version. Microsoft notes that some versions have more than one update package and all of them are needed. For CVE-2026-65660, the fixed builds are 16.0.19725.20522 for Subscription Edition, 16.0.10417.20198 for SharePoint 2019 and 16.0.5565.1001 for SharePoint 2016.
2. Ask whether it needs to be on the internet
A SharePoint server reachable from anywhere is a target for anyone. If staff only use it in the office, or can reach it over a VPN, close it off from the open internet.
3. Check for compromise if it was exposed
If the server was public-facing and behind on updates, patching closes the hole but does not undo anything already done. Look for unfamiliar files in the web folders, new accounts and odd scheduled tasks, or have someone do it for you. Our incident response playbook explains how to preserve evidence first.
4. Decide whether to keep running it
For most small businesses, the honest question is why SharePoint is still on a local server at all. Moving to SharePoint Online hands patching to Microsoft. Our cloud migration guide covers how to plan it.
Sources
- CISA: Known Exploited Vulnerabilities Catalog (checked November 13, 2026)
- Microsoft Security Response Center: CVE-2026-65660
- Microsoft Security Response Center: CVE-2026-55040
- Microsoft Security Response Center: CVE-2026-58644
- Microsoft Security Response Center: CVE-2026-50522
Common questions
We use SharePoint in Microsoft 365. Are we affected?
Microsoft's advisories for these flaws list on-premises products: SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016. SharePoint Online, the version inside Microsoft 365, is run and patched by Microsoft, so there is nothing for you to install.
Did CISA add new SharePoint flaws in late October 2026?
Not according to CISA's catalog as of November 13, 2026. The most recent SharePoint entry is CVE-2026-65660, added September 25, 2026.
Is installing the update enough?
Install every update Microsoft lists for your version; Microsoft says some versions need more than one package. If your server was reachable from the internet before you patched, also check it for signs of compromise, because patching does not remove anything an attacker already left behind.
