---
title: "CVE-2026-65660 SharePoint SafeControls Check"
canonical: https://trickest.com/library/cve-2026-65660-sharepoint-safecontrols
description: "Compare a self-hosted SharePoint farm build to the 2026-08-11 SafeControls fix for CVE-2026-65660, then check anonymous access. GET only. No exploit payload."
---

# CVE-2026-65660 SharePoint SafeControls Check

## Overview

This workflow takes a list of self-hosted SharePoint URLs and tells you which farms still run a build older than the 2026-08-11 fix for CVE-2026-65660. SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition publish a build number the detect node can read. SharePoint Server 2013 is end of life and has no fix in this graph. Detect sends GET requests to the farm and classifies the build. It does not post a payload and it does not write to the farm. A second node then checks whether anonymous access is enabled, which is the precondition for a pre-auth path. That check is also GET only. Point the list at scope you are authorised to test and treat an affected build as the ticket for [exposure management](/use-cases/exposure-management).

Run it again when farms are patched or new sites appear. A build that was in range last week should come back patched after the August update.

## Pipeline

1. `targets` reads a file of SharePoint URLs, or writes `https://sharepoint.example.com` when none is attached.
2. `detect` GETs the farm and reads the build. Each row is classified against the fixed builds from the 2026-08-11 patch.
3. `poc` runs after detect. It checks whether anonymous access is enabled. It does not send an exploit payload.
4. `summary` writes counts by status and the affected subset.

## Inputs

- **Target file.** SharePoint URLs, one per line, or JSONL with `url` or `host`. If no file is attached, the default is `https://sharepoint.example.com`.

## Outputs

- **`sharepoint_findings.jsonl`.** One detect row per URL: target, product, version, and status.
- **`sharepoint_poc.jsonl`.** The detect row plus whether anonymous access was enabled.
- **`summary.jsonl`.** One object: targets checked, status counts, and the affected subset.

## Integrations

- HTTP. Unauthenticated GET to the farm. The anonymous-access check is a second GET. Neither request posts a payload.

## Sample output

The records below are an illustrative fixture for the default host, not a live result. They show the shape of a farm the version oracle does not recognise, so the anonymous-access check does not run.

### `detect`

```jsonl
{"target": "https://sharepoint.example.com", "product": "unknown", "version": "", "cve": "CVE-2026-65660", "status": "NOT_SHAREPOINT", "evidence": "no SharePoint markers"}
```

### `poc`

```jsonl
{"target": "https://sharepoint.example.com", "cve": "CVE-2026-65660", "status": "NOT_SHAREPOINT", "poc_mode": "canary_non_intrusive", "poc_attempted": false, "poc_result": "skipped_not_sharepoint"}
```

### `summary`

```json
{"cve": "CVE-2026-65660", "product": "Microsoft SharePoint Server", "targets_checked": 1, "status_counts": {"NOT_SHAREPOINT": 1}, "poc_result_counts": {"skipped_not_sharepoint": 1}, "affected_targets": []}
```

## FAQ

### Which builds does this flag as affected?

Builds older than the 2026-08-11 fix. SharePoint Server 2016 is fixed at 16.0.5565.1001. SharePoint Server 2019 is fixed at 16.0.10417.20198. Subscription Edition is fixed at 16.0.19725.20522. SharePoint Server 2013 has no fix in this graph.

### Does an affected row mean the farm was exploited?

No. Affected is a build comparison. The second node only checks whether anonymous access is enabled. It does not send an exploit payload.

### When does the anonymous-access check run?

It runs only for SharePoint rows detect already marked affected. A host that is not SharePoint is skipped. A host outside the affected range is skipped.

### Is this check safe on production?

Both steps are read-only GET. Run it only against scope you are authorised to test.

## Related workflows

- [SharePoint RCE check (CVE-2025-53770)](/library/sharepoint-rce-check-cve-2025-53770). Reach for this when the question is the 2025 ToolShell check rather than the 2026-08-11 build floor.
- [SharePoint XML deserialization (CVE-2019-0604)](/library/cve-2019-0604-sharepoint-xml-deserialization-rce). Reach for this when the farm question is the 2019 advisory rather than CVE-2026-65660.

---
_Markdown source of https://trickest.com/library/cve-2026-65660-sharepoint-safecontrols._