1.0 Introduction
Recently,
Microsoft released security updates to address a code injection vulnerability
(CVE-2026-65660) in on-premises SharePoint Server.
2.0 Impact
The flaw exists within
SharePoint’s SafeControls validation mechanism, which is designed to restrict
the loading of potentially dangerous server-side controls. Successful
exploitation allows an authenticated attacker to bypass these restrictions,
load arbitrary .NET classes, and execute malicious code on the SharePoint
server.
3.0 Affected
Versions
·
SharePoint Server Subscription Edition, build
number earlier than 16.0.19725.20522 (KB5002893)
·
SharePoint Server 2019
· SharePoint Server
4.0 Recommendation
CyberSecurity Malaysia encourages users and administrators
to review the Microsoft
MSRC Security Update Guide and apply the necessary updates.
Kindly refer to the following URLs for more
information:
Generally, CyberSecurity Malaysia advise users and
administrators to be updated with the latest security announcements by the
vendor and follow best practice security policies to determine which updates
should be applied.
For further enquiries, please contact Cyber999 Incident the
Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored
during business hours)
Mobile: +60 19 2665850 (24x7
call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References