New SharePoint Vulnerability: What SMBs Need to Do Now

What is CVE-2026-65660 and why should SMBs care?

CVE-2026-65660 is a code injection vulnerability in Microsoft SharePoint. This flaw allows attackers to inject and execute malicious code on vulnerable SharePoint servers. Because SharePoint is often used to store and manage sensitive business data, this vulnerability poses a serious threat to organizations that rely on it.

The vulnerability has already been exploited in the wild, meaning attackers are actively using it to gain unauthorized access to systems. For SMBs, this could lead to data breaches or other malicious activities that can disrupt operations and damage your reputation.

SMBs are particularly vulnerable because they may not have the resources or expertise to detect and patch such flaws quickly. If you're using SharePoint in your business, you need to understand the risks and take immediate action.

Does this vulnerability affect my SMB?

If your business uses Microsoft SharePoint, especially an outdated or unpatched version, you're at risk. SharePoint is commonly used in businesses for document sharing, workflow automation, and internal communication. If your organization relies on SharePoint for these tasks, you should check if you're running a vulnerable version.

The vulnerability is specific to SharePoint, so if you're using other platforms like Google Workspace and not using SharePoint, you're likely not affected. However, if SharePoint is part of your digital infrastructure, even as a secondary tool, it's important to investigate.

Even if SharePoint isn't central to your operations, any external access or integration with third-party tools could expose your network to this vulnerability. Attackers could use SharePoint as a gateway to access other systems or sensitive data.

What should I do this week to protect my business?

First, check if your SharePoint environment is up to date. Microsoft has released a patch for this vulnerability, and it's critical that you apply it as soon as possible. If you're unsure how to apply the patch, reach out to your IT team or managed service provider.

Second, review your SharePoint and IIS logs for any unusual activity. Look for unexpected login attempts, unauthorized file access, or changes to user permissions. These could be signs that an attacker has already exploited the vulnerability.

Third, consider running a security assessment to evaluate your overall exposure. A professional assessment can identify other vulnerabilities and help you strengthen your defenses beyond just SharePoint.

Finally, ensure that your employees are aware of the risks and trained to recognize potential phishing or social engineering attacks. While the vulnerability is technical, attackers often use human error as a stepping stone.

How can I tell if my business has already been hit?

If your SharePoint environment has been compromised, you may notice unusual behavior such as unexpected files being added or modified, unexplained login attempts, or performance issues on SharePoint pages.

You can also check system logs for any unauthorized access attempts or changes to user permissions. If you see activity that doesn’t match normal user behavior, it could be a sign that an attacker has exploited the vulnerability.

If you suspect a breach, act quickly. Isolate the affected systems if possible, and contact a cybersecurity professional to help investigate and remediate the issue. Delaying action can lead to more damage and increased recovery costs.

Not sure whether your environment is exposed? That is exactly what our Vulnerability Management service is built to surface. Talk to us.

Frequently asked questions

Source (public domain): CISA