Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

Microsoft confirms that CVE-2026-65660, a SharePoint remote code execution flaw patched during August 2026's Patch Tuesday, is being actively exploited roughly six weeks after the fix shipped and just days after researchers published technical analysis. The bug lets an authenticated attacker with minimal privileges run arbitrary code without any user interaction, and was originally misclassified by Microsoft as a medium-severity spoofing issue before being upgraded to high-severity RCE. Microsoft says it has reliable evidence of real-world attacks dated September 25, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, setting a September 28 remediation deadline for federal agencies. Threat intelligence firm Previdian observed exploitation attempts starting September 24, including efforts to plant webshell backdoors, shortly after Vietnamese security firm Viettel—the original discoverer—released technical details; the attacker's identity remains unknown, and this marks the eighth SharePoint vulnerability patched this year to land on CISA's KEV list.