SharePoint Flaw Exploited in Real-World Attacks

A Microsoft SharePoint vulnerability tracked as CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details.

CVE-2026-65660 is a remote code execution vulnerability fixed by Microsoft with its August 2026 Patch Tuesday updates. The company's advisory describes it as a code injection issue that lets an authenticated attacker with low-level access to an affected server execute arbitrary code without user interaction.

According to Microsoft, as of September 25, 2026, the company had reliable evidence of observed attacks against exploitation of this vulnerability.

The attacks appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details. It's unclear who is behind the attacks.