Microsoft SharePoint Vulnerability CVE-2026-65660 Actively Exploited

Microsoft SharePoint vulnerability CVE-2026-65660 is actively being leveraged in cyberattacks, according to recent findings.

Vulnerability Details

The flaw, addressed through Microsoft’s August 2026 Patch Tuesday updates, allows an authenticated user with minimal privileges to execute arbitrary code on affected systems without requiring user interaction. Microsoft confirmed in its updated advisory that exploitation attempts have been observed since September 25, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) included the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog on the same date, imposing a three-day deadline for federal agencies to apply patches.

Microsoft confirmed in its updated advisory that exploitation attempts have been observed since September 25, 2026.

CISA’s Inclusion

The Cybersecurity and Infrastructure Security Agency (CISA) included the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog on the same date, imposing a three-day deadline for federal agencies to apply patches.

Threat Intelligence Reports

Previdian’s Findings

Threat intelligence provider Previdian reported initial exploitation activity on September 24, 2026, followed by attempts to deploy webshell backdoors on September 25. The attacks appear to coincide with the disclosure of technical details by Viettel Security, the researchers who initially reported the vulnerability to Microsoft.

Previdian noted that in-the-wild exploits align with the technical information published by Viettel.

Vulnerability Reclassification

Initially categorized as a medium-severity spoofing issue, the flaw was later reclassified as a high-severity remote code execution (RCE) vulnerability. The vulnerability stems from a type-check bypass that enables code execution for authenticated users. Unauthenticated RCE requires combining this flaw with an additional authentication bypass vulnerability.

Technical and Security Implications

Exploitation Mechanics

Microsoft’s advisory highlights that the flaw does not require user interaction, making it particularly dangerous for environments with compromised credentials. The company emphasized that exploitation is limited to authenticated attackers with low-level access, though the potential for escalation remains significant.

Urgency of Patching

The timeline of events underscores the urgency of patching, as threat actors rapidly weaponize disclosed vulnerabilities. Organizations are advised to prioritize applying the available updates to mitigate risks associated with this flaw.