Microsoft 365 threat report

CVE-2026-65660, a SharePoint Server vulnerability affecting 2016, 2019, and Subscription Edition, was initially misclassified by Microsoft as a spoofing flaw but actually enables authenticated remote code execution via arbitrary .NET class loading and deserialization. Microsoft patched the flaw on August 11, 2026; no in-the-wild exploitation has been reported, though full technical details and working exploit code were published on September 22, 2026.

• SharePoint Flaw Initially Listed as Spoofing by Microsoft Enable(opens in a new tab)
• Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute R(opens in a new tab)
• CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited i(opens in a new tab)
• Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attack(opens in a new tab)
• CVE-2026-65660: SharePoint Flaw Exploited, CISA Warns(opens in a new tab)
• CVE-2026-65660: Critical SharePoint vulnerability - SecNews.gr(opens in a new tab)