CVE-2026-65660 SharePoint SafeControls Check

Overview

This workflow takes a list of self-hosted SharePoint URLs and tells you which farms still run a build older than the 2026-08-11 fix for CVE-2026-65660. SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition publish a build number the detect node can read. SharePoint Server 2013 is end of life and has no fix in this graph. Detect sends GET requests to the farm and classifies the build. It does not post a payload and it does not write to the farm. A second node then checks whether anonymous access is enabled, which is the precondition for a pre-auth path. That check is also GET only. Point the list at scope you are authorised to test and treat an affected build as the ticket for exposure management.

Run it again when farms are patched or new sites appear. A build that was in range last week should come back patched after the August update.

Pipeline

1. targets reads a file of SharePoint URLs, or writes https://sharepoint.example.com when none is attached.
2. detect GETs the farm and reads the build. Each row is classified against the fixed builds from the 2026-08-11 patch.
3. poc runs after detect. It checks whether anonymous access is enabled. It does not send an exploit payload.
4. summary writes counts by status and the affected subset.

Inputs

• Target file. SharePoint URLs, one per line, or JSONL with url or host. If no file is attached, the default is https://sharepoint.example.com.

Outputs

• sharepoint_findings.jsonl. One detect row per URL: target, product, version, and status.
• sharepoint_poc.jsonl. The detect row plus whether anonymous access was enabled.
• summary.jsonl. One object: targets checked, status counts, and the affected subset.

Integrations

• HTTP. Unauthenticated GET to the farm. The anonymous-access check is a second GET. Neither request posts a payload.

Sample output

The records below are an illustrative fixture for the default host, not a live result. They show the shape of a farm the version oracle does not recognise, so the anonymous-access check does not run.

detect

poc

summary

{"cve": "CVE-2026-65660", "product": "Microsoft SharePoint Server", "targets_checked": 1, "status_counts": {"NOT_SHAREPOINT": 1}, "poc_result_counts": {"skipped_not_sharepoint": 1}, "affected_targets": []}

FAQ

Which builds does this flag as affected?

Builds older than the 2026-08-11 fix. SharePoint Server 2016 is fixed at 16.0.5565.1001. SharePoint Server 2019 is fixed at 16.0.10417.20198. Subscription Edition is fixed at 16.0.19725.20522. SharePoint Server 2013 has no fix in this graph.

Does an affected row mean the farm was exploited?

No. Affected is a build comparison. The second node only checks whether anonymous access is enabled. It does not send an exploit payload.

When does the anonymous-access check run?

It runs only for SharePoint rows detect already marked affected. A host that is not SharePoint is skipped. A host outside the affected range is skipped.

Is this check safe on production?

Both steps are read-only GET. Run it only against scope you are authorised to test.

Related workflows

• SharePoint RCE check (CVE-2025-53770). Reach for this when the question is the 2025 ToolShell check rather than the 2026-08-11 build floor.
• SharePoint XML deserialization (CVE-2019-0604). Reach for this when the farm question is the 2019 advisory rather than CVE-2026-65660.