A Microsoft SharePoint bug that the company first waved off as a low-stakes “spoofing” issue has turned into one of the more awkward vulnerability disclosures of 2026. CVE-2026-65660, patched quietly in the August 11 round of Patch Tuesday updates, is now confirmed under active exploitation. The Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog on September 25, and set a remediation deadline of September 28, 2026, for federal civilian agencies. That deadline lands today.
The bug carries a CVSS score of 8.8, according to the National Vulnerability Database, a full two points above the 6.5 rating Microsoft originally assigned it, and third-party trackers were still reaffirming that same 8.8 figure as of September 2026, according to WindowsForum. Independent researchers say the gap between those two numbers isn’t a rounding error, it reflects a real disagreement about how dangerous the flaw actually is. On-premises SharePoint Server 2016, 2019, and Subscription Edition are all affected, and enterprise IT teams that run those builds now have a same-day compliance clock and, more urgently, an active attacker problem.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-65660, and Why Is It on Everyone’s Patch List?
CVE-2026-65660 is a code-injection flaw in Microsoft Office SharePoint, tracked under CWE-94, “improper control of generation of code.” In plain terms, the vulnerability lives in how SharePoint validates entries on its SafeControls list, the mechanism meant to stop untrusted or dangerous code classes from loading inside the platform. When that check can be bypassed, an attacker who already holds a valid, low-privilege account on the SharePoint server gains a path to run arbitrary code on it.
Microsoft’s own advisory, per the NVD entry, describes the flaw this way: the issue allows “an authorized attacker to perform spoofing over a network.” That phrasing, “spoofing,” is the crux of the controversy. Spoofing bugs typically rank lower on the severity scale because they trick a system rather than seize control of it. Security researchers who dug into the patch disagreed with that framing almost immediately.
From “Spoofing” to Remote Code Execution: A Classification U-Turn
According to reporting from The Hacker News, Viettel Cyber Security researcher Dinh Ho Anh Khoa found that the flaw could be chained into authenticated remote code execution, not merely spoofing, despite Microsoft’s initial classification. That distinction matters enormously for anyone trying to triage patch queues. A spoofing bug might sit in the “patch this quarter” bucket. A remote-code-execution bug with a public exploitation confirmation sits in the “patch this weekend” bucket, and CISA’s KEV listing effectively forced that reclassification for federal networks.
SecurityWeek reported on September 27, 2026 that active exploitation was underway, and that the practical effect of the bug lets an authenticated attacker with only low-level access execute code without any user interaction required, something Microsoft itself had already acknowledged back in its original August 2026 advisory. No phishing click, no macro approval, no victim action of any kind. Once an attacker has any valid SharePoint credential, whether stolen, purchased, or obtained through credential stuffing, the exploitation step itself is silent.
Timeline: How an August Patch Became a September KEV Emergency
The gap between “patched” and “publicly flagged as exploited” is one of the more revealing numbers in this story. Microsoft shipped the fix for CVE-2026-65660 on August 11, 2026, as part of that month’s Patch Tuesday cycle. CISA didn’t add the CVE to its KEV catalog until September 25, six weeks later, which means organizations had over a month where the patch existed but the urgency signal did not. That’s the exact window attackers rely on: the fix is public, so the vulnerability details are reverse-engineerable, but defenders haven’t yet been told to prioritize it.
- August 11, 2026 – Microsoft releases the patch as part of the August Patch Tuesday cycle
- Weeks following – Independent researchers, including Dinh Ho Anh Khoa, publish analysis disputing the “spoofing” label
- September 25, 2026 – CISA adds CVE-2026-65660 to the KEV catalog, citing confirmed exploitation
- September 28, 2026 – Federal civilian remediation deadline hits
CISA’s own KEV announcement, posted to its official account and cited by SecurityAffairs, stated plainly: “We added Microsoft SharePoint vulnerability CVE-2026-65660 … to our KEV Catalog.” F5 Labs independently corroborated both the September 25, 2026 KEV addition date and the September 28, 2026 federal remediation deadline in its own writeup of the catalog update. The same batch of additions included a MikroTik RouterOS flaw, underscoring that CISA’s Friday-to-Monday KEV cadence rarely deals with a single product at a time.
CVE-2026-65660 at a Glance
| Detail | Data Point |
|---|---|
| CVE identifier | CVE-2026-65660 |
| Vendor / product | Microsoft SharePoint Server |
| Vulnerability class | CWE-94, code injection |
| CVSS score (NVD) | 8.8 (High) |
| CVSS score (Microsoft, original) | 6.5 |
| Authentication required | Yes, low-privilege account |
| User interaction required | No |
| Affected versions | SharePoint Server 2016, 2019, Subscription Edition |
| SharePoint Online affected | Not reported as affected |
| Patch release date | August 11, 2026 |
| CISA KEV addition date | September 25, 2026 |
| Federal remediation deadline | September 28, 2026 |
Why CISA’s September 28 Deadline Matters Beyond Federal Networks
CISA’s binding operational directive process only legally compels U.S. federal civilian executive branch agencies to patch by a KEV-listed deadline. But the catalog functions as a de facto industry alarm bell. Cyber insurers, state and local governments, and large enterprises routinely track KEV additions as part of their own patch-priority scoring, because a listing confirms exploitation is happening in the wild rather than sitting as theoretical risk in a CVSS writeup.
For organizations running on-premises SharePoint Server, today’s deadline is a useful forcing function even outside government. SharePoint sits at the center of a lot of quietly critical infrastructure: HR document repositories, contract management, internal wikis, and often, poorly audited permission structures built up over a decade of ad hoc site creation. A single compromised low-privilege account, exactly the kind CVE-2026-65660 requires, can be the pivot point into that entire environment.
Who’s Behind the Attacks? Attribution Gaps and Exploitation Patterns
Here’s where the public record gets thin, and it’s worth being honest about that rather than filling the gap with speculation. No security vendor or government agency has publicly attributed CVE-2026-65660 exploitation to a named ransomware group or nation-state actor as of this writing. CISA’s KEV inclusion criteria require confirmed exploitation, not a confirmed attacker identity, and those two things are frequently reported at different speeds.
What is documented is a possible chaining risk: some reporting notes that CVE-2026-65660, when combined with other SharePoint misconfigurations, such as on-premises deployments that still permit anonymous access, could contribute to a pre-authentication compromise path even though the base vulnerability itself requires authentication. That’s a meaningful nuance for defenders. The CVE isn’t unauthenticated on its own, but sloppy access controls elsewhere in a SharePoint farm can effectively erase that barrier.
Which SharePoint Versions Are Exposed
Three on-premises SharePoint editions carry the flaw: SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The fixed builds, per Microsoft’s August 2026 advisory, are 16.0.5565.1001 for SharePoint Server 2016, 16.0.10417.20198 for SharePoint Server 2019, and 16.0.19725.20522 for Subscription Edition, numbers administrators can check directly against their farm’s current build. Microsoft’s advisory notes that the same knowledge-base patch number applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016, so administrators running either variant need the identical update, according to Rapid7’s vulnerability database entry. SharePoint Online, Microsoft’s cloud-hosted version, is not listed among the affected products, since Microsoft patches that environment centrally without customer action.
That on-premises-only scope is the throughline connecting this bug to a much bigger, uncomfortable pattern for Microsoft: SharePoint Server keeps being the entry point for serious attacks, while the cloud-hosted sibling product largely stays out of the headlines.
CVE-2026-65660 vs. the 2025 ToolShell Attacks
Anyone who tracked enterprise security news in 2025 will remember ToolShell, the exploitation chain built around CVE-2025-53770 and CVE-2025-53771 that hit exposed on-premises SharePoint servers hard enough to trigger emergency guidance from Microsoft and mass patching across government and enterprise networks alike. CVE-2026-65660 is a different bug, but the shape of the problem, and the shape of the response, rhymes uncomfortably closely.
| Characteristic | CVE-2026-65660 (2026) | ToolShell CVEs (2025) |
|---|---|---|
| Primary classification | Code injection, initially labeled spoofing | Chained SharePoint exploitation flaws |
| Authentication needed | Yes, low-privilege account | Chains could enable pre-authentication attacks |
| Reported impact | Authenticated remote code execution | Remote compromise, web-shell deployment |
| Products affected | SharePoint Server 2016, 2019, Subscription Edition | On-premises SharePoint Server environments |
| Named threat actor | Not publicly confirmed | Tracked by multiple vendors, attribution varied |
| CISA response | KEV addition, Sept. 25, 2026 | Emergency remediation guidance, 2025 |
The most important operational difference is the authentication requirement. ToolShell’s chains could threaten exposed servers before normal login access in certain configurations, which is what made it so viral among opportunistic scanners. CVE-2026-65660 requiring a valid account, even a low-privilege one, in theory narrows the blast radius. In practice, credential theft is cheap and common enough in 2026 that the distinction may matter less to defenders than it does to vulnerability taxonomists.
SharePoint’s Recurring Zero-Day Problem
SharePoint Server has become something of a repeat offender in the KEV catalog’s short history. The platform’s core architectural challenge hasn’t changed in a decade: it’s designed to be deeply extensible, with custom web parts, workflows, and third-party add-ins all running with elevated trust inside the same application boundary as core document management. That extensibility is exactly why enterprises adopted it in the first place, and it’s exactly why the SafeControls mechanism at the center of CVE-2026-65660 exists, and exactly why bypassing it is so consequential.
Compare that to the security posture Microsoft has been able to build around SharePoint Online. Cloud-hosted, centrally patched, and increasingly isolated from customer-managed code, the online version has largely avoided this category of headline. The gap between on-premises SharePoint’s vulnerability history and SharePoint Online’s relatively quiet one is arguably Microsoft’s strongest internal argument for cloud migration, whether or not that’s how the company frames it publicly.
Market Impact: Microsoft, Enterprise IT Budgets, and Security Vendors
The immediate financial impact of a single CVE rarely shows up cleanly in a stock chart, and CVE-2026-65660 is no exception. But the secondary effects are measurable in a different way: incident-response hours, emergency patch-management contracts, and a fresh talking point for the vendors selling SharePoint-adjacent security tooling. Vulnerability management platforms including Tenable and Rapid7 both added CVE-2026-65660 to their databases with upgrade guidance shortly after Microsoft’s original advisory, which is standard practice, but the KEV listing six weeks later is what typically triggers a second wave of customer notifications and prioritized scanning across managed security service providers.
For enterprises still running on-premises SharePoint Server, there’s a less visible cost: this is another data point pushing IT leadership toward Microsoft 365 and SharePoint Online migrations, projects that are rarely cheap or fast, but that increasingly get justified internally by exactly this kind of recurring patch fire drill. Migration vendors and Microsoft’s own cloud sales teams have every incentive to point at CVE-2026-65660 in renewal conversations this quarter.
The Broader September 2026 KEV Surge: SharePoint Isn’t Alone
CVE-2026-65660 landed in the KEV catalog during a genuinely busy stretch for enterprise vulnerability disclosures. In the same window, GitLab urged immediate patching for CVE-2026-85706, described as a maximum-severity path-traversal flaw. Check Point disclosed CVE-2026-85102, a pre-authentication remote-code-execution bug in Security Gateway certificate handling, alongside a related flaw, CVE-2026-85103, that was significant enough to prompt a Dutch national cybersecurity warning about imminent exploitation. Citrix, meanwhile, pushed updates for two critical NetScaler remote-code-execution bugs, CVE-2026-88771 and CVE-2026-88772, both reported under active exploitation.
Separately, a vulnerability in Tencent’s Sogou Input Method for Windows, CVE-2026-51990, was reportedly exploited by a China-aligned espionage group to deploy a backdoor tracked as GrayRabbit. None of these are directly connected to the SharePoint flaw, but together they paint a picture of a September where enterprise security teams were triaging critical, actively exploited bugs across collaboration platforms, network appliances, and DevOps infrastructure simultaneously, a workload problem that’s arguably as newsworthy as any single CVE.
What Security Teams Should Do Right Now
The remediation path for CVE-2026-65660 is, at least, straightforward compared to the attribution and classification confusion around it. Administrators running affected SharePoint Server editions should confirm the August 2026 security update is installed, verify build numbers against Microsoft’s advisory, and audit low-privilege accounts for signs of anomalous activity given the authenticated nature of the exploit.
# Check installed SharePoint Server build version via PowerShell
Get-SPFarm | Select-Object BuildVersion
# Cross-reference against Microsoft's August 2026 security update KB
# for SharePoint Server 2016 / 2019 / Subscription Edition before
# confirming remediation of CVE-2026-65660- Confirm the August 11, 2026 security update is installed on every SharePoint Server node, not just the primary application server
- Review SafeControls configuration entries for unexpected or unrecognized additions
- Audit accounts with any level of SharePoint access for unusual authentication patterns since mid-August
- Disable anonymous access on any on-premises SharePoint site collections that don’t strictly require it
- Cross-check exposed SharePoint instances against CISA’s KEV catalog on a recurring basis, not just after a breaking-news alert
How SharePoint’s Security Response Stacks Up Against Rival Platforms
It’s worth putting Microsoft’s six-week gap between patch release and KEV-driven urgency in context against how competing enterprise collaboration platforms have handled comparable disclosures. Cloud-native competitors that don’t offer a self-hosted server product, by design, remove the “patch lag” variable entirely, since the vendor controls deployment timing. That’s a structural advantage that on-premises SharePoint simply can’t replicate without asking customers to migrate off the product entirely.
The trade-off, and the reason large regulated enterprises and government agencies still run SharePoint Server rather than moving everything to the cloud, is data residency and control requirements that on-premises deployment satisfies more directly. CVE-2026-65660 is, in effect, the recurring cost of that trade-off: organizations get to keep SharePoint data inside their own network perimeter, but they also inherit the patch-timing risk that comes with managing the server themselves rather than letting Microsoft manage it centrally.
5 Predictions for the Next 90 Days
- Expect a second SharePoint CVE disclosure before year-end. The pattern of researchers re-examining a patched bug and finding a deeper issue, as happened with the spoofing-to-RCE reclassification here, tends to produce follow-on advisories within a few months.
- State and local governments will adopt informal KEV-deadline compliance even without a federal mandate, following the same pattern seen after the 2025 ToolShell incidents.
- Cyber insurers will start asking specifically about on-premises SharePoint Server exposure in renewal questionnaires, mirroring how they already ask about unpatched VPN appliances.
- Microsoft will face renewed pressure to accelerate SharePoint Online migration incentives for enterprise customers still running Server 2016, which is approaching the tail end of its extended support lifecycle.
- Attribution for CVE-2026-65660 exploitation will likely surface within weeks from a major incident-response vendor, once enough compromised environments have been forensically examined to identify a common actor or toolkit.
Frequently Asked Questions
What is CVE-2026-65660?
CVE-2026-65660 is a code-injection vulnerability in Microsoft SharePoint Server, affecting the 2016, 2019, and Subscription Edition releases. It carries a CVSS score of 8.8 according to the NVD and allows an authenticated, low-privilege attacker to execute code on an affected server.
Is SharePoint Online affected by CVE-2026-65660?
No. Available Microsoft and vendor documentation identifies only on-premises SharePoint Server editions as affected. SharePoint Online, the cloud-hosted version, is centrally managed and patched by Microsoft and is not listed among impacted products.
When did Microsoft patch CVE-2026-65660?
Microsoft released the fix on August 11, 2026, as part of that month’s Patch Tuesday security updates.
What is the CISA remediation deadline for CVE-2026-65660?
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 25, 2026, and set September 28, 2026, as the remediation deadline for U.S. federal civilian executive branch agencies.
Does exploiting CVE-2026-65660 require authentication?
Yes. Current technical analysis describes the vulnerability as requiring an authenticated attacker with low-privilege access to the SharePoint server. No user interaction from a victim is required once that access is obtained.
Is CVE-2026-65660 related to the 2025 ToolShell SharePoint attacks?
They are separate vulnerabilities. ToolShell involved CVE-2025-53770 and CVE-2025-53771 and included attack chains that could threaten exposed servers under certain configurations before standard authentication. CVE-2026-65660 is a distinct, newer flaw that requires an authenticated account, though both target the same class of on-premises SharePoint Server deployment.
Who is exploiting CVE-2026-65660?
No security vendor or government agency has publicly attributed exploitation of CVE-2026-65660 to a specific named threat actor or ransomware group as of this report. CISA’s KEV listing confirms active exploitation without naming an attacker.
How can I check if my SharePoint Server is patched against CVE-2026-65660?
Administrators should verify the installed build version against Microsoft’s August 2026 security update knowledge-base article for their specific SharePoint edition, using tools like PowerShell’s Get-SPFarm cmdlet to confirm the current build number, then cross-referencing it with Microsoft’s official advisory.
