Microsoft Azure threat report

CVE-2026-65660, a critical code-injection vulnerability in Microsoft SharePoint Server 2016, 2019, and Subscription Edition, enables authenticated remote code execution despite being initially misclassified by Microsoft as a spoofing flaw with lower severity. Microsoft patched the flaw on August 11, 2026; full technical exploit details were published September 22, 2026. No in-the-wild exploitation has been reported, though the vulnerability allows attackers to bypass SafeControls restrictions and execute arbitrary code via deserialization.

• SharePoint Flaw Initially Listed as Spoofing by Microsoft Enable(opens in a new tab)
• Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute R(opens in a new tab)
• CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited i(opens in a new tab)
• Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attack(opens in a new tab)
• Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attack(opens in a new tab)