[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-65660":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-25T20:08:38.509Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":62,"aliases":63,"duplicate_of":9,"upstream":64,"downstream":65,"duplicates":66,"related":67,"reserved_at":9,"published_at":68,"modified_at":69,"state":70,"summary":71,"references_raw":82,"kevs":101,"epss":112,"epss_history":114,"metrics":253,"affected":262},"CVE-2026-65660","Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-94","Improper Control of Generation of Code ('Code Injection')","The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","weakness","Draft","Base","Medium",[20,24,58],{"id":21,"name":22,"techniques":23},"CAPEC-242","Code Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[28,39,46],{"id":29,"name":30,"tactics":31,"countermeasures":38},"T1027.006","HTML Smuggling",[32,35],{"id":33,"name":34},"TA0030","Defense Evasion",{"id":36,"name":37},"TA0005","Stealth",[],{"id":40,"name":41,"tactics":42,"countermeasures":45},"T1027.009","Embedded Payloads",[43,44],{"id":33,"name":34},{"id":36,"name":37},[],{"id":47,"name":48,"tactics":49,"countermeasures":52},"T1564.009","Resource Forking",[50,51],{"id":33,"name":34},{"id":36,"name":37},[53],{"id":54,"name":55,"tactic":56},"D3-FFV","File Format Verification",{"name":57},"Isolate",{"id":59,"name":60,"techniques":61},"CAPEC-77","Manipulating User-Controlled Variables",[],[],[],[],[],[],[],"2026-08-11T17:04:55.666Z","2026-09-25T19:58:23.746Z","Analyzed",{"cisa_kev":72,"cisa_ransomware":73,"cisa_vendor":74,"epss_severity":75,"epss_score":76,"severity":77,"severity_score":78,"severity_version":79,"severity_source":80,"severity_vector":81,"severity_status":70},true,false,"Microsoft","low",0.01221,"high",8.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",[83,90,95],{"url":84,"sources":85,"tags":87},"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660",[80,86],"nvd",[88,89],"Vendor Advisory","Patch",{"url":91,"sources":92,"tags":93},"https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/",[80,86],[94],"Third Party Advisory",{"url":96,"sources":97,"tags":98},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660",[80,86],[99,100],"Government Resource","US Government Resource",[102],{"source":103,"vendor":74,"product":104,"date_added":105,"vulnerability_name":106,"short_description":107,"required_action":108,"due_date":109,"known_ransomware_campaign_use":110,"notes":111,"exploitation_type":9},"cisa","SharePoint","2026-09-25","Microsoft SharePoint Code Injection Vulnerability","Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-09-28","Unknown","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-65660",{"date":105,"score":76,"percentile":113},0.6743,[115,119,122,126,129,132,136,139,142,145,148,151,154,157,160,163,166,170,173,176,179,182,185,188,191,194,197,200,203,206,209,212,215,218,221,224,227,230,233,236,239,242,245,248,252],{"date":116,"score":117,"percentile":118},"2026-08-12",0.00683,0.49296,{"date":120,"score":117,"percentile":121},"2026-08-13",0.49333,{"date":123,"score":124,"percentile":125},"2026-08-14",0.00684,0.4942,{"date":127,"score":124,"percentile":128},"2026-08-15",0.49527,{"date":130,"score":124,"percentile":131},"2026-08-16",0.49545,{"date":133,"score":134,"percentile":135},"2026-08-17",0.00742,0.51643,{"date":137,"score":134,"percentile":138},"2026-08-18",0.51667,{"date":140,"score":134,"percentile":141},"2026-08-19",0.51848,{"date":143,"score":134,"percentile":144},"2026-08-20",0.51899,{"date":146,"score":134,"percentile":147},"2026-08-21",0.51946,{"date":149,"score":134,"percentile":150},"2026-08-22",0.51959,{"date":152,"score":134,"percentile":153},"2026-08-23",0.51547,{"date":155,"score":134,"percentile":156},"2026-08-24",0.51884,{"date":158,"score":134,"percentile":159},"2026-08-25",0.51916,{"date":161,"score":134,"percentile":162},"2026-08-26",0.51993,{"date":164,"score":134,"percentile":165},"2026-08-27",0.52036,{"date":167,"score":168,"percentile":169},"2026-08-28",0.00807,0.53828,{"date":171,"score":168,"percentile":172},"2026-08-29",0.53858,{"date":174,"score":168,"percentile":175},"2026-08-30",0.54293,{"date":177,"score":168,"percentile":178},"2026-08-31",0.54302,{"date":180,"score":168,"percentile":181},"2026-09-01",0.54328,{"date":183,"score":168,"percentile":184},"2026-09-02",0.54369,{"date":186,"score":168,"percentile":187},"2026-09-03",0.54392,{"date":189,"score":168,"percentile":190},"2026-09-04",0.54422,{"date":192,"score":168,"percentile":193},"2026-09-05",0.54046,{"date":195,"score":168,"percentile":196},"2026-09-06",0.5448,{"date":198,"score":168,"percentile":199},"2026-09-07",0.54489,{"date":201,"score":168,"percentile":202},"2026-09-08",0.54508,{"date":204,"score":168,"percentile":205},"2026-09-09",0.54674,{"date":207,"score":168,"percentile":208},"2026-09-10",0.54704,{"date":210,"score":168,"percentile":211},"2026-09-11",0.54738,{"date":213,"score":168,"percentile":214},"2026-09-12",0.54805,{"date":216,"score":168,"percentile":217},"2026-09-13",0.54799,{"date":219,"score":168,"percentile":220},"2026-09-14",0.54825,{"date":222,"score":168,"percentile":223},"2026-09-15",0.54903,{"date":225,"score":168,"percentile":226},"2026-09-16",0.55063,{"date":228,"score":168,"percentile":229},"2026-09-17",0.55143,{"date":231,"score":168,"percentile":232},"2026-09-18",0.55265,{"date":234,"score":168,"percentile":235},"2026-09-19",0.55299,{"date":237,"score":168,"percentile":238},"2026-09-20",0.55293,{"date":240,"score":168,"percentile":241},"2026-09-21",0.54871,{"date":243,"score":168,"percentile":244},"2026-09-22",0.55319,{"date":246,"score":168,"percentile":247},"2026-09-23",0.55357,{"date":249,"score":250,"percentile":251},"2026-09-24",0.01192,0.66634,{"date":105,"score":76,"percentile":113},[254,259],{"source":80,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":255,"cvss_v4_0":9},{"baseScore":78,"baseSeverity":256,"vectorString":81,"impactScore":257,"exploitabilityScore":258},"HIGH",9.8,7.2,{"source":86,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":260,"cvss_v4_0":9},{"baseScore":78,"baseSeverity":256,"vectorString":261,"impactScore":257,"exploitabilityScore":258},"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[263,275,282,289],{"ecosystem":9,"name":264,"vendor":265,"product":266,"cpe_part":267,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":268},"Microsoft SharePoint Enterprise Server 2016","microsoft","microsoft sharepoint enterprise server 2016","a",[269],{"version":270,"is_range":72,"range_type":80,"version_start":271,"version_start_type":272,"version_end":273,"version_end_type":274,"fixed_in":9},">= 16.0.0, \u003C 16.0.5565.1001","16.0.0","including","16.0.5565.1001","excluding",{"ecosystem":9,"name":276,"vendor":265,"product":277,"cpe_part":267,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":278},"Microsoft SharePoint Server 2019","microsoft sharepoint server 2019",[279],{"version":280,"is_range":72,"range_type":80,"version_start":271,"version_start_type":272,"version_end":281,"version_end_type":274,"fixed_in":9},">= 16.0.0, \u003C 16.0.10417.20198","16.0.10417.20198",{"ecosystem":9,"name":283,"vendor":265,"product":284,"cpe_part":267,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":285},"Microsoft SharePoint Server Subscription Edition","microsoft sharepoint server subscription edition",[286],{"version":287,"is_range":72,"range_type":80,"version_start":271,"version_start_type":272,"version_end":288,"version_end_type":274,"fixed_in":9},">= 16.0.0, \u003C 16.0.19725.20522","16.0.19725.20522",{"ecosystem":9,"name":290,"vendor":265,"product":291,"cpe_part":267,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":292},"SharePoint Server","sharepoint_server",[293,296,298],{"version":294,"is_range":72,"range_type":295,"version_start":9,"version_start_type":9,"version_end":288,"version_end_type":274,"fixed_in":9},"lt16.0.19725.20522","cpe",{"version":297,"is_range":73,"range_type":295,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"2016",{"version":299,"is_range":73,"range_type":295,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"2019"]