Project
Microsoft's on-premises server platform for enterprise document management, intranet portals, and team collaboration.
CVE-2026-65660, an exploited SharePoint Server code injection flaw rated 8.8, lets any user with a low-privilege login run code on the farm. Farms that admit vendors and contractors need to count who can sign in, alongside what faces the internet.
Reality
Symantec says Warlock operators ran an AV/EDR killer across at least 40 machines in roughly two hours after a suspected SharePoint compromise. The ransomware payloads moved between domain controllers through SYSVOL replication.
Reality
Dinh Ho Anh Khoa's writeup turns CVE-2026-65660 into authenticated remote code execution on SharePoint 2016, 2019 and Subscription Edition. Microsoft's advisory scores the flaw 6.5 and calls it spoofing. NVD scores it 8.8.
Reality
Microsoft's July update fixes 622 vulnerabilities, 62 of them rated critical. The two it says attackers are already using, in AD FS and SharePoint Server, sit below that line, so exploited status has to order the work.
Reality
Attackers are forging tokens SharePoint accepts, then enumerating management APIs and probing Business Connectivity Services for the execution sink. BleepingComputer reports nobody has seen that last step land.
Reality