Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

A Microsoft SharePoint vulnerability tracked as CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details.

CVE-2026-65660 is a remote code execution vulnerability fixed by Microsoft with its August 2026 Patch Tuesday updates. The company’s advisory describes it as a code injection issue that lets an authenticated attacker with low-level access to an affected server execute arbitrary code without user interaction. 

“As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability,” Microsoft said in its updated advisory. 

CISA added CVE-2026-65660 to its KEV catalog on September 25, giving federal agencies a patching deadline of September 28.

Early-warning threat intelligence platform Previdian (formerly KEVIntel) reported seeing exploitation attempts on September 24. On September 25, the company saw attempts to create a webshell backdoor. 

It’s unclear who is behind the attacks, which appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details.

Advertisement. Scroll to continue reading.

Viettel noted that Microsoft initially classified the vulnerability as a medium-severity spoofing issue, but later revised its assessment to a high-severity remote code execution flaw.

Microsoft rates CVE-2026-65660 as an authenticated flaw, requiring low-level privileges but no user interaction. On its own, the vulnerability is a type-check bypass that yields code execution for an authenticated attacker; reaching unauthenticated RCE requires chaining it with a separate authentication bypass weakness.

Previdian noted that the in-the-wild exploits it observed appeared to be based on the technical information shared by Viettel.

CISA’s KEV catalog currently includes 16 SharePoint vulnerabilities, including eight discovered and patched this year.

Related: Critical WordPress Vulnerability Exploited Immediately After Disclosure

Related: Arista Urges Immediate Patching of Exploited VCO Zero-Day

Related: Critical F5 BIG-IP Vulnerability Exploited as Zero-Day