CVE-2026-65660 Exploited in Attacks on Microsoft SharePoint

A Microsoft SharePoint vulnerability tracked as CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details.

The remote code execution flaw was fixed by Microsoft with its August 2026 Patch Tuesday updates. The company’s advisory describes it as a code injection issue that lets an authenticated attacker with low-level access to an affected server execute arbitrary code without user interaction.

‘As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability,’ Microsoft said in its updated advisory.

The attackers appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details. The exact identity behind these attacks is still unclear.