Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

Summary

Microsoft SharePoint vulnerability CVE-2026-65660, a remote code execution flaw, is now being actively exploited in the wild. Microsoft confirmed observed attacks after researchers disclosed technical details, and CISA added it to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 28. The vulnerability requires authentication but allows an attacker to execute arbitrary code.

Full text

A Microsoft SharePoint vulnerability tracked as CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details. CVE-2026-65660 is a remote code execution vulnerability fixed by Microsoft with its August 2026 Patch Tuesday updates. The company’s advisory describes it as a code injection issue that lets an authenticated attacker with low-level access to an affected server execute arbitrary code without user interaction. “As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability,” Microsoft said in its updated advisory. CISA added CVE-2026-65660 to its KEV catalog on September 25, giving federal agencies a patching deadline of September 28. Early-warning threat intelligence platform Previdian (formerly KEVIntel) reported seeing exploitation attempts on September 24. On September 25, the company saw attempts to create a webshell backdoor. It’s unclear who is behind the attacks, which appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details.Advertisement. Scroll to continue reading. Viettel noted that Microsoft initially classified the vulnerability as a medium-severity spoofing issue, but later revised its assessment to a high-severity remote code execution flaw. Microsoft rates CVE-2026-65660 as an authenticated flaw, requiring low-level privileges but no user interaction. On its own, the vulnerability is a type-check bypass that yields code execution for an authenticated attacker; reaching unauthenticated RCE requires chaining it with a separate authentication bypass weakness. Previdian noted that the in-the-wild exploits it observed appeared to be based on the technical information shared by Viettel. CISA’s KEV catalog currently includes 16 SharePoint vulnerabilities, including eight discovered and patched this year. Related: Critical WordPress Vulnerability Exploited Immediately After Disclosure Related: Arista Urges Immediate Patching of Exploited VCO Zero-Day Related: Critical F5 BIG-IP Vulnerability Exploited as Zero-Day Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public DataOT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS IntegratorsUS Court Sentences Armenian Man to Prison for Ryuk Ransomware AttacksHoneywell: OT Security Teams Embrace AI, but Autonomy Still RareAI-Powered Phishing Platform EvilTokens Disrupted by MicrosoftShinyHunters Claims FBI Hack, Demands Retraction of Threat ReportNightmare Eclipse Drops New Microsoft Defender Exploit After Revealing IdentityOnly 13% of OT Network Segments Are Fully Isolated: Analysis Latest News China and US Agree to Establish AI Safety Channel and Continue Trade and Military TalksNew x47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingOpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior DisclosureIn Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility ExposureNorth Korea Suspected in $351 Million Bitget Crypto HeistCISA Election Security Plan Flags Patching Barriers, Voter Database AttacksKosovar Owner of Rydox Marketplace Pleads Guilty in US CourtWindows, Linux, Android File Notification Systems Leak User Activity Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveDoppel has named Joey Rachid as Chief Security Advisor and Field Chief Information Security Officer.Delinea has appointed Timothy Regan as Chief Financial Officer.Gwen Gann has become State Chief Information Security Officer for the State of Washington at WaTech.More People On The MoveExpert Insights Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-65660

Entities