SharePoint flaw CVE-2026-65660 came under attack within days of Viettel's technical write-up
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
The Watch · Security desk
What happened
- CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on September 25 and set September 28 as the federal patching deadline.
- Previdian, formerly KEVIntel, logged exploitation attempts on September 24 and attempts to create a webshell backdoor on September 25.
- On its own the bug is a type-check bypass that needs a low-privilege login; unauthenticated code execution requires chaining a separate authentication bypass.
- According to Viettel, Microsoft first classified the flaw as a medium-severity spoofing issue and later revised it to high-severity remote code execution.
Why it matters
- Who has to decide decision Teams that deferred the August SharePoint fix because of its original spoofing label decided on a rating Microsoft has since revised, so that deferral needs reopening now.
- Who's exposed exposure Any low-privilege account on an unpatched server is enough to reach code execution. The number of people and service accounts with logins sets the size of the exposure.
- What it limits constraint Three days from listing to deadline leaves federal teams little time to check for webshells on servers that were exposed before they patched.
- What it sets up precedent Half of SharePoint's catalogued exploited flaws landed this year. A new SharePoint fix with public research behind it is a probable target, and patching it in the first cycle is the sensible default.
Next story · Security · Oct 9
Honeypots log exploitation attempts against SonicWall SMA1000 flaw three days after patchConfirmed7 publishers
Viettel Security found the bug and reported it to Microsoft. Attacks appear to have started shortly after its researchers published technical details [8]. Previdian said the exploits it observed in the wild appeared to be based on Viettel's information [10]. For exposure planning, the write-up set the clock. Live attempts followed it by a couple of days [1].
Microsoft's updated advisory gives a date for its own evidence. "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability," the company said [2]. Previdian's first sighting came one day earlier [13].
The login requirement limits who can use this bug. Microsoft's advisory describes code injection that lets an authenticated attacker with low-level access run arbitrary code without user interaction [4]. The public reporting does not identify the attackers. It also does not say whether they used accounts they already held or chained an authentication bypass [8][5]. The webshell attempts show the attackers wanted to keep access [7]. In my view, a server that was reachable and unpatched on September 24 is an open incident until someone has searched it for a webshell [7].
On the published evidence, this is exploitation built from public research, with no named actor behind it [8][10]. It fits a longer run for the product. CISA's catalog lists 16 SharePoint vulnerabilities, eight of them discovered and patched this year [12].
What to watch
- Any report that attackers are chaining an authentication bypass with CVE-2026-65660, removing the login requirement and widening the set of reachable servers.
- Attribution of the September 24-25 activity to a named group, which would separate opportunistic use of Viettel's research from a sustained campaign.
- Counts from Microsoft or Previdian of servers found carrying webshells tied to this flaw.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 21%
- Operator
- Operator 79%
- Investor
- Investor 0%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details.
- [2]
"As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability,"
- [3]
CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on September 25, giving federal agencies a patching deadline of September 28.
- [4]
Microsoft's advisory describes CVE-2026-65660 as a code injection issue that lets an authenticated attacker with low-level access to an affected server execute arbitrary code without user interaction.
- [5]
On its own, CVE-2026-65660 is a type-check bypass that yields code execution for an authenticated attacker with low-level privileges; reaching unauthenticated RCE requires chaining it with a separate authentication bypass weakness.
- [6]
CVE-2026-65660 is a Microsoft SharePoint remote code execution vulnerability fixed with Microsoft's August 2026 Patch Tuesday updates.
- [7]
Previdian (formerly KEVIntel) reported seeing exploitation attempts on September 24 and, on September 25, attempts to create a webshell backdoor.
- [8]
It is unclear who is behind the attacks, which appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details.
- [9]
Viettel said Microsoft initially classified the vulnerability as a medium-severity spoofing issue, then revised its assessment to a high-severity remote code execution flaw.
- [10]
Previdian noted that the in-the-wild exploits it observed appeared to be based on the technical information shared by Viettel.
- [11]
CISA gave federal agencies three days between adding CVE-2026-65660 to KEV and the patching deadline.
- [12]
CISA's KEV catalog currently includes 16 SharePoint vulnerabilities, including eight discovered and patched this year.
- [13]
Previdian's first observed exploitation attempts came one day before the date Microsoft gave for its reliable evidence of attacks.
- [14]
Half of the SharePoint vulnerabilities in CISA's KEV catalog were discovered and patched this year.
Sources
4 independent publishers whose own reporting we read for this story.
- cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog
1 article · September 25, 2026
- securityaffairs.comU.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog
1 article · September 25, 2026
- securityweek.comMicrosoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks - SecurityWeek
2 articles · September 27, 2026
- thehackernews.comSharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
2 articles · September 26, 2026