Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

1. Executive summary

CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint rated CVSS 8.8 HIGH, is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-25 with a federal remediation deadline of 2026-09-28. Microsoft patched the flaw in its August 2026 Patch Tuesday cycle and states it has reliable evidence of observed attacks as of 2026-09-25. Exploitation is authenticated: the attacker needs low-level privileges on the affected server, but no user interaction, and Previdian has already observed attempts to establish webshell backdoors. Attribution is unknown. EMEA financial services firms running internet-facing or internally reachable SharePoint servers that have not applied the August 2026 updates should treat this as an immediate patching priority.

2. Regulatory framing

No specific NIS2 article is directly engaged by this item beyond general patching duties; the supply chain and reporting triggers in the reference do not attach to facts specific to this vulnerability.

3. Technical analysis & attack chain

CVE-2026-65660 is a code injection vulnerability in Microsoft SharePoint, fixed in the August 2026 Patch Tuesday release. NVD classifies it as CWE-94 (Code Injection). Microsoft's advisory describes an authenticated attacker with low-level access to an affected server executing arbitrary code over a network without user interaction. The CVSS score is 8.8 HIGH per the verified reference data; note that Viettel Security reported Microsoft initially assessed the issue as a medium-severity spoofing flaw before revising it to high-severity remote code execution.

The vulnerability mechanism, per Viettel's disclosure as reported by SecurityWeek, is a type-check bypass. Exploitation yields code execution for an authenticated attacker. Reaching unauthenticated RCE requires chaining CVE-2026-65660 with a separate authentication bypass weakness; no such chain has been confirmed in the observed attacks.

Confirmed attack chain, from the source material:

1. Microsoft releases patches for CVE-2026-65660 with the August 2026 Patch Tuesday updates.
2. Viettel Security, which reported the vulnerability to Microsoft, discloses technical details roughly six weeks after patching.
3. Previdian (formerly KEVIntel) observes exploitation attempts on 2026-09-24, one day before the KEV listing. Previdian assesses the in-the-wild exploits as based on the technical information Viettel shared.
4. On 2026-09-25, Previdian observes attempts to create a webshell backdoor, indicating post-exploitation persistence attempts on compromised or targeted servers.
5. Microsoft updates its advisory on 2026-09-25 to state it has reliable evidence of observed attacks. CISA adds the CVE to KEV the same day with a 2026-09-28 due date.

CISA's KEV entry records known ransomware campaign use as Unknown. No threat actor attribution has been made; treat any naming of a group behind these attacks as unconfirmed. The specific webshell filename, path, or content is not described in the available sources, and the authentication route used by the attackers (which low-privilege access they obtained) is not specified.

Context worth noting: CISA's KEV catalog now lists 16 SharePoint vulnerabilities, eight of them discovered and patched in 2026, including CVE-2026-45659 (CVSS 8.8, deserialization RCE, added to KEV in July 2026) and CVE-2026-58644 (CVSS 9.8, deserialization zero-day, added in July 2026). SharePoint is a repeated target and this is not an isolated event.

4. Mitigation & containment

P1, within 24 hours:

• Apply the August 2026 Patch Tuesday SharePoint fixes to all SharePoint servers, prioritising internet-facing instances. The CISA KEV due date of 2026-09-28 applies to US federal agencies but is a sound external benchmark for your own deadline.
• Inventory SharePoint deployments, including those run by third parties or within SaaS arrangements, and confirm patch levels. If a SharePoint server cannot be patched immediately, remove or restrict its internet exposure at the reverse proxy or WAF layer.
• Hunt for webshells on SharePoint servers: review the SharePoint web root and virtual directories for newly created or modified .aspx, .asp, and .ashx files, and alert on anomalous writes to IIS application paths.

P2, within 72 hours:

• Review authentication logs on SharePoint servers for low-privilege account activity preceding 2026-09-24, particularly accounts with minimal legitimate use that suddenly issued application-layer requests to the affected components.
• If exploitation is confirmed, treat it as a code execution incident: isolate the host, capture forensic images, and run the incident classification process under your DORA Art. 18 framework to determine whether Art. 19 reporting thresholds are met.
• Verify that the separate authentication bypass weakness referenced as a chaining prerequisite is also patched; unauthenticated RCE depends on it.

P3, within 7 days:

• Add CVE-2026-65660 to your vulnerability management register with the KEV listing and Microsoft advisory as evidence, and confirm your patch SLA for KEV-listed internet-facing assets meets or beats the CISA due date.
• Where SharePoint is provided by an ICT third-party provider, obtain written confirmation of patch status and patch SLAs under your contractual arrangements.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe observable behaviour but no atomic indicators. Previdian's observations are single-sourced; verify before enforcement.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The sources name no webshell filenames, paths, strings, or hashes. A rule built from the CVE identifier or the vendor advisory text would detect reporting about the threat, not the threat itself. The behavioural hunting steps in §4 (P1 and P2) are the available detection surface until concrete artefacts are published.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• SecurityWeek, "Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks," https://www.securityweek.com/microsoft-sharepoint-flaw-cve-2026-65660-now-exploited-in-attacks/, 2026-09-27
• NVD / CISA KEV, "CVE-2026-65660 — Microsoft SharePoint Code Injection Vulnerability," https://nvd.nist.gov/vuln/detail/CVE-2026-65660, KEV added 2026-09-25
• The Hacker News, "SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild," https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html, 2026-09-25
• The Hacker News, "SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation," https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html, July 2026
• NVD / CISA KEV, "CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability," https://nvd.nist.gov/vuln/detail/CVE-2026-56164, KEV due date 2026-07-17
• SecurityWeek, "CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability," https://www.securityweek.com/cisa-warns-of-actively-exploited-sharepoint-vulnerability/, July 2026
• The Hacker News, "CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV," https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html, July 2026

8. Adverse Trace position

We assess this as a high-severity, actively exploited vulnerability that demands immediate patch verification across all SharePoint estates, with CVSS 8.8 HIGH, CISA KEV listing as of 2026-09-25, and confirmed webshell deployment attempts in the wild. The authentication requirement lowers the blast radius relative to an unauthenticated RCE, but low-privilege SharePoint access is cheap for an attacker to obtain and the observed webshell activity shows post-exploitation intent, not scanning. Attribution is unknown and we treat it as such. The exploitation timeline, six weeks from patch release to in-the-wild abuse following public technical disclosure, is a recurring pattern for SharePoint and reinforces the case for short patch SLAs on this product family. The Previdian observations and the Viettel technical detail are single-sourced at the time of writing; we will monitor for corroborating IOC releases and Microsoft guidance updates, and we will issue a follow-up note if a webshell artefact set, an authentication bypass chain, or actor attribution is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.