Microsoft SharePoint Flaw CVE-2026-65660 Exploited in Attacks

Summary

Microsoft says it has evidence of attacks exploiting SharePoint RCE flaw CVE-2026-65660, patched in August. Observed attempts included creating a webshell; CISA added the flaw to its KEV catalog.

Key points

• Microsoft says it had reliable evidence of attacks exploiting CVE-2026-65660 as of September 25, 2026.
• The flaw is a remote code execution vulnerability in SharePoint, fixed in Microsoft's August 2026 Patch Tuesday updates.
• Exploitation requires an authenticated attacker with low-level access and no user interaction; unauthenticated RCE requires chaining the flaw with a separate authentication bypass.
• Previdian reported exploitation attempts on September 24 and attempts to create a webshell backdoor on September 25.
• The attacks' perpetrators are unknown. Previdian said observed exploits appeared to use technical information disclosed by Viettel Security.
• CISA added the vulnerability to its KEV catalog on September 25 and set a September 28 patching deadline for federal agencies.

MITRE ATT&CK

CVE

Vendors

Products

Related Articles

• CISA Adds Two Actively Exploited Vulnerabilities to KEV CatalogCVE-2026-65660 · Microsoft SharePoint
• Actively Exploited SharePoint Flaw Enables Remote Code ExecutionCVE-2026-65660 · T1505.003
• Storm-2603 Expands SharePoint Exploitation in Attacks on Critical InfrastructureMicrosoft SharePoint · T1505.003
• Recorded Future Reports 215 Actively Exploited CVEs and Expanding Supply-Chain Threats in H1 2026Microsoft SharePoint · T1505.003
• Hunt.io Maps 3,923 Potentially Malicious Infrastructure Endpoints Across Eastern EuropeMicrosoft SharePoint · T1505.003