CVE-2026-65660

Think of SharePoint like your office’s shared filing system and identity directory. This flaw can let a legitimate (already authorized) attacker trick SharePoint into pretending to be other people or systems, which can expose files or let them do things they shouldn’t. It doesn’t require employees to click anything—an attacker just needs the ability to authenticate to SharePoint.

This matters if your business runs Microsoft SharePoint Server (including Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition). Because the attacker must be an authorized user, the risk is highest if someone can sign in (for example, via stolen credentials or an overly-permissive account). Only a risk if an attacker already has an account that can reach and use SharePoint (authentication is required).

This is RED because it enables authenticated spoofing that can lead to high confidentiality loss, and patch attention is fresh. Even though there’s no confirmed KEV entry in the provided sources and no public exploit code on record, you should treat it as an urgent patch for any environment that’s reachable by authenticated users.