SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).

Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated.

CVE-2026-65660 is an improper control of code generation (CWE-94) flaw in Microsoft Office SharePoint Server that allows an authenticated, low-privilege attacker to inject and execute arbitrary code over a network. The bug is triggered after login by sending crafted input that SharePoint processes and executes, so any account with basic access to the SharePoint site — including a standard user — is a viable attack path. Successful exploitation yields remote code execution on the SharePoint server with the privileges of the SharePoint service account, threatening full compromise of confidentiality, integrity, and availability (CVSS 8.8). Notably, Microsoft initially classified the flaw as spoofing before it was recharacterized as authenticated RCE, and Canada's Cyber Centre has issued advisory AL26-023 about it. A public proof-of-concept exists on GitHub, but the issue is not in CISA's KEV catalog and there are no confirmed reports of in-the-wild exploitation yet, though EPSS (1.2%, 67th percentile) suggests above-average likelihood of attempted exploitation.

Do: Apply Microsoft's security update for SharePoint Server from the corresponding Patch Tuesday release as soon as possible, prioritizing any server reachable from the internet or exposed to broad internal user populations. Because exploitation only requires an authenticated low-privilege account, review recent SharePoint audit logs for anomalous behavior by ordinary users (unexpected page/app modifications, unusual requests preceding process activity), and enforce least-privilege access so standard accounts cannot reach sensitive site collections. Verify patch levels across all SharePoint farms, including pre-production and forgotten servers, and monitor Microsoft's advisory and the Canadian Cyber Centre's AL26-023 for updates on active exploitation.