Cyber security / Global business systems
Canada warns of active exploitation affecting SharePoint Server
Canada's Cyber Centre warned on 24 September of active exploitation affecting SharePoint Server.
- Review cut-off
- Review window
- 2026-09-23 to 2026-09-24
- Published by Caracal Intelligence
Historical review. Published after the period covered. The cut-off is the end of the review date in UTC. We compare source dates and known updates with this cut-off. Some sources lack exact times or earlier versions. Business effects below are possible outcomes, not confirmed losses.
Reported event · 2026-09-24
What happened
Canada's Cyber Centre warned on 24 September of active exploitation affecting SharePoint Server. The alert described CVE-2026-65660 and risks from chaining it with other vulnerabilities on insufficiently updated servers.
Evidence: [1]
Caracal analysis / Possible effects
Global logistics
Compromise of a document or collaboration system could affect shipment records, supplier instructions, and shared production plans. Recovery could require access restrictions and verification of stored documents.
Trade and supply chains
Stolen information or forged instructions could create commercial and payment risks. Exposure would depend on the deployment, patch state, access settings, and related weaknesses.
Industries to watch
Logistics providers, manufacturers, engineering firms, and service suppliers using on-premises SharePoint should review their own and managed environments.
- Logistics technology
- Manufacturing
- Professional services
What to check next
- Identify affected servers and apply current vendor guidance.
- Investigate signs of compromise before restoring normal access.
Sources and evidence limits
[1] Canadian Centre for Cyber Security · Official alert AL26-023 · Published 2026-09-24
Canada warns of active exploitation affecting SharePoint Server — source report
The alert concerned SharePoint Server. It should not be treated as proof of a breach at every SharePoint or Microsoft cloud customer.
Sources and claims checked on . This check compares the brief with dated source reports. It does not independently confirm every reported incident. Check current conditions before you change an operating plan.