Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

Attackers are exploiting patched Microsoft SharePoint flaw CVE-2026-65660, which CISA added to KEV.

Microsoft SharePoint vulnerability CVE-2026-65660 is now being exploited, about six weeks after patches in the August 2026 Patch Tuesday updates. It is an authenticated code-injection flaw that lets a low-privileged attacker execute arbitrary code without user interaction; Microsoft later raised it from medium-severity spoofing to high-severity remote code execution. Microsoft said it had reliable evidence of attacks as of September 25, 2026, and CISA added the flaw to the KEV catalog that day with a September 28 deadline for federal agencies. Previdian reported exploitation attempts on September 24 and webshell-creation attempts on September 25, shortly after Viettel Security published technical details. Unauthenticated RCE would require chaining a separate authentication bypass.