Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
Attackers are exploiting patched Microsoft SharePoint flaw CVE-2026-65660, which CISA added to KEV.
Microsoft SharePoint vulnerability CVE-2026-65660 is now being exploited, about six weeks after patches in the August 2026 Patch Tuesday updates. It is an authenticated code-injection flaw that lets a low-privileged attacker execute arbitrary code without user interaction; Microsoft later raised it from medium-severity spoofing to high-severity remote code execution. Microsoft said it had reliable evidence of attacks as of September 25, 2026, and CISA added the flaw to the KEV catalog that day with a September 28 deadline for federal agencies. Previdian reported exploitation attempts on September 24 and webshell-creation attempts on September 25, shortly after Viettel Security published technical details. Unauthenticated RCE would require chaining a separate authentication bypass.
- CVE-2026-65660 is authenticated SharePoint RCE requiring low privileges.
- Microsoft confirmed observed attacks as of September 25, 2026.
- CISA added it to KEV with a September 28 federal deadline.
- Observers saw webshell-creation attempts after technical details were published.
- Microsoft patched it in the August 2026 Patch Tuesday updates.
Vulnerabilities mentionedAll →
- CVE-2026-656608.82%Authenticated Code Injection RCE in Microsoft SharePoint Serverpublished · Microsoft SharePoint Server KEV PoC ×2
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article305 words · extracted from securityweek.com · click to collapse
A Microsoft SharePoint vulnerability tracked as CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details.
CVE-2026-65660 is a remote code execution vulnerability fixed by Microsoft with its August 2026 Patch Tuesday updates. The company’s advisory describes it as a code injection issue that lets an authenticated attacker with low-level access to an affected server execute arbitrary code without user interaction.
“As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability,” Microsoft said in its updated advisory.
CISA added CVE-2026-65660 to its KEV catalog on September 25, giving federal agencies a patching deadline of September 28.
Early-warning threat intelligence platform Previdian (formerly KEVIntel) reported seeing exploitation attempts on September 24. On September 25, the company saw attempts to create a webshell backdoor.
It’s unclear who is behind the attacks, which appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details.
Advertisement. Scroll to continue reading.
Viettel noted that Microsoft initially classified the vulnerability as a medium-severity spoofing issue, but later revised its assessment to a high-severity remote code execution flaw.
Microsoft rates CVE-2026-65660 as an authenticated flaw, requiring low-level privileges but no user interaction. On its own, the vulnerability is a type-check bypass that yields code execution for an authenticated attacker; reaching unauthenticated RCE requires chaining it with a separate authentication bypass weakness.
Previdian noted that the in-the-wild exploits it observed appeared to be based on the technical information shared by Viettel.
CISA’s KEV catalog currently includes 16 SharePoint vulnerabilities, including eight discovered and patched this year.
Related: Critical WordPress Vulnerability Exploited Immediately After Disclosure
Related: Arista Urges Immediate Patching of Exploited VCO Zero-Day
Related: Critical F5 BIG-IP Vulnerability Exploited as Zero-Day