A Microsoft SharePoint vulnerability known as CVE-2026-65660 is now being exploited for attacks, about six weeks after Microsoft announced patches and a few days after researchers disclosed technical details.
CVE-2026-65660 is a remote code execution vulnerability that was addressed by Microsoft in the August 2026 Patch Tuesday updates. The company’s advisory describes it as a code injection issue that allows an authenticated attacker with low access to an affected server to execute arbitrary code without user interaction.
“As of September 25, 2026, Microsoft had reliable evidence of observed attacks against the exploitation of this vulnerability,” Microsoft said in its updated release advisory.
CISA added CVE-2026-65660 added to the KEV catalog on September 25th, giving federal authorities a patch deadline of September 28th.
Previdian (formerly KEVIntel), an early warning threat intelligence platform, reported an incident Exploitation attempts on September 24th. On September 25, the company saw attempts to create a webshell backdoor.
It is unclear who is behind the attacks, which appear to have begun shortly after the disclosure by Viettel Security, whose researchers reported the vulnerability to Microsoft technical details.
Viettel noted that Microsoft initially classified the vulnerability as a moderate spoofing issue, but later revised its assessment to a high-severity remote code execution flaw.
Microsoft classifies CVE-2026-65660 as an authenticated bug that requires low privileges but no user interaction. The vulnerability is a type check bypass that allows an authenticated attacker to execute code; To achieve unauthenticated RCE, it must be chained to a separate authentication bypass vulnerability.
Previdian noted that the observed exploits in the wild appeared to be based on the technical information shared by Viettel.
CISA’s KEV catalog currently includes 16 SharePoint vulnerabilities, including eight that were discovered and fixed this year.
Related: Critical WordPress vulnerability was exploited immediately after disclosure
Related: Arista urges immediate patching of exploited VCO zero-day
Related: Critical F5 BIG-IP vulnerability exploited as a zero-day
