SharePoint CVE-2026-65660 Exploited: Patch and Hunt Web Shells

What should your team do today? Follow these steps in order.

1. Confirm your exposure. List every SharePoint Server farm, including forgotten test and departmental instances, and note which are reachable from the internet or allow anonymous access.

2. Apply the August 2026 updates. The fixed builds are 16.0.19725.20522 or later for Subscription Edition, 16.0.10417.20198 or later for SharePoint 2019, and 16.0.5565.1001 or later for SharePoint 2016. Verify the build number on every server, not just the farm console.

3. Hunt before you relax. Treat any server that was internet-reachable and unpatched after September 24 as potentially compromised. Search for unexpected .aspx files in SharePoint layout directories, unusual child processes spawned by the IIS worker process, and new scheduled tasks or accounts.

4. Rotate secrets if you find anything. If there is evidence of a web shell, rotate service account passwords and the farm's machine keys, because the attacker may have read them.

5. Harden the front door. Place SharePoint behind a reverse proxy that requires authentication, turn on Antimalware Scan Interface (AMSI) integration, and require multi-factor authentication for administrators.

6. Feed your monitoring. Send SharePoint, IIS and authentication logs to your SIEM and alert on the indicators above, so the next advisory is a search query rather than a scramble.

Teams without the capacity to run this around the clock can lean on managed IT services for asset inventory, patch orchestration and backup, so a recovery point exists if a server must be rebuilt.

Why change how you handle systems that feel like routine internal tools? Because attackers already treat them as high-value entry points.

Faster, cleaner containment. When SharePoint logs are monitored continuously, a web shell appears as an anomaly within hours. Without monitoring, the same intruder can stay for weeks while pivoting to file servers and identity systems.

Less data exposure. SharePoint concentrates sensitive documents. Reducing time-to-detect directly reduces how much data an attacker can copy before you cut access.

Compliance evidence. Regulators, cyber insurers and enterprise customers increasingly ask how quickly exploited vulnerabilities are remediated. A documented process that references the CISA KEV catalog and records the date of each fix answers that with facts.

Smaller blast radius. Segmenting the SharePoint farm from domain controllers and backup systems, using the kind of redundant, segmented paths built with multi-operator connectivity and SD-WAN, limits what a compromised server can reach.

A repeatable playbook. The same steps apply to the next zero-day in a VPN, firewall or mail gateway. One well-rehearsed procedure is worth more than ten improvised ones.

HIT Communications has operated enterprise networks and communications for more than 30 years across Latin America, the United States and Europe. We see vulnerability response as part of one connected environment: network, servers, identity, voice and cloud.

Our cybersecurity services combine a 24/7 SOC, SIEM and managed detection and response to find web shells and other persistence, validate indicators of compromise and guide containment while patches are tested. Our IT managed services keep inventories, patching and backups under control so that an advisory like this one becomes a routine change, not a crisis. And our multi-operator connectivity and SD-WAN designs provide segmented, redundant paths that limit the reach of any single compromised host.

If your organization runs on-premises SharePoint, Exchange or other self-hosted collaboration systems, we can help you confirm exposure, hunt for compromise and set up the monitoring that shortens the next response.

CVE-2026-65660 shows how a fixed vulnerability can still cause a breach: the severity label was revised late, the exploit chains two weaknesses, and a web shell outlives the patch. The right response is to patch, then hunt, then harden and monitor.

If you are not sure which SharePoint servers are exposed, whether they were checked after September 24, or whether anyone is watching their logs around the clock, now is the time to find out. Contact HIT Communications and schedule a conversation with our team to review your exposure and your detection and response approach.