Is CVE-2026-65660 actively exploited?

Yes. Previdian has observed exploitation attempts targeting this CVE. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian sensors have observed 16 exploitation attempts, 2 unique attacker IPs, and 2 countries targeting CVE-2026-65660. First observed Sep 24, 2026.

Which versions are affected?

CVE-2026-65660 affects Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 other products. Reported affected versions include 16.0.0 to < 16.0.5565.1001, 16.0.0 to < 16.0.10417.20198, and 16.0.0 to < 16.0.19725.20522.

How should organizations remediate it?

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

No. CVE-2026-65660 is not currently listed in CISA KEV.

CVE-2026-65660 Exploitation Observed — Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Q: What is CVE-2026-65660?

CVE-2026-65660 is Microsoft SharePoint Server Remote Code Execution Vulnerability. Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Q: How should organizations remediate it?

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

Q: Is it in CISA KEV?

No. CVE-2026-65660 is not currently listed in CISA KEV.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-65660 is Microsoft SharePoint Server Remote Code Execution Vulnerability. Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code...

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence.

Who is affected?

Microsoft / Microsoft SharePoint Enterprise Server 2016 affected before 16.0.5565.1001.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Microsoft SharePoint Server Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Vendor Product Affected Status

Microsoft Affected

Microsoft SharePoint Enterprise Server 2016

Before 16.0.5565.1001

Affected

Microsoft Affected

Microsoft SharePoint Server 2019

Before 16.0.10417.20198

Affected

Microsoft Affected

Microsoft SharePoint Server Subscription Edition

Before 16.0.19725.20522

Affected

View vendor advisory

Published: 11 Aug 2026
Exploitation Reported: 24 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: Low
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-65660
Microsoft SharePoint Server Remote Code Execution Vulnerability msrc.microsoft.com · Vendor Advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Previdian

Recorded 24 Sep 2026

Previdian independently recorded this as exploited after first seeing it in honeypot sensors.

Active exploitation observed

Previdian sensor

First observed 24 Sep 2026

Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Previdian First	2026-09-24 12:32 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.

16

Attempts observed

2

Unique attacker IPs

2

Attacker countries

GB · IL

1

Sensors observed

CVE-2026-65660 exploitation attempts over the last 7 days

Daily events observed by Previdian sensors

Updated 24 Sep 2026

0

16

18 Sep 19 Sep 20 Sep 21 Sep 22 Sep 23 Sep 24 Sep

First observed 24 Sep 2026 · Last observed 24 Sep 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Request telemetry access

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 7; 2; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

0.8%

Weaknesses

Improper Control of Generation of Code ('Code Injection') CWE-94

Recent mention · The Hacker News

22 Sep 2026

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

Swati KhandelwalSep 22, 2026Vulnerability / Web Security A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published...

Read full advisory

All Mentions

Recent mention · The Hacker News

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

The Hacker News · 22 Sep 2026

Swati KhandelwalSep 22, 2026Vulnerability / Web Security A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition. Patches have been available since the August 11 security updates, and the National Vulnerability Database scores it 8.8. Microsoft's advisory describes CVE-2026-65660 as...

Recent mention · Rapid7

Patch Tuesday - August 2026

Rapid7 · 11 Aug 2026

Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for one of the vulnerabilities published today, as well as public disclosure for two others, although the Notable CVEs section of the Security Update Guide omits one of these. As usual, browser vulns are...

Recent mention · Tenable Blog

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)

Tenable Blog · 11 Aug 2026

42Critical355Important1Moderate0LowMicrosoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild.Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727.This month’s update includes patches for:.NET.NET Core.NET FrameworkAMD ZenActive Directory Certificate Services (AD CS)Application Information ServicesAzure Active DirectoryAzure CycleCloudAzure Monitor...

Recent mention · Tenable Blog

Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)

Tenable Blog · 11 Aug 2026

42Critical355Important1Moderate0LowMicrosoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild.Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727.This month’s update includes patches for:.NET.NET Core.NET FrameworkAMD ZenActive Directory Certificate Services (AD CS)Application Information ServicesAzure Active DirectoryAzure CycleCloudAzure Monitor...

Timeline

From disclosure to observed exploitation

24 Sep 2026
12:05 UTC

Indicators of compromise added (2)

Indicators of compromise recorded
24 Sep 2026
12:05 UTC

Observed by Previdian sensors

Evidence-backed exploitation signal
22 Sep 2026
11:22 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 2 days of early warning before Previdian confirmed it as a KEV.
11 Aug 2026
17:04 UTC

CVE published

Vulnerability disclosed publicly
22 Jul 2026
18:16 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-65660

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-65660",
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": 0.00807,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 16, "sensors": 1 }
}

CVE-2026-65660

Microsoft SharePoint Server Remote Code Execution Vulnerability

Tags

CVE References

Exploited in the wild

Active exploitation observed

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Attacker IP Indicators

Weaknesses

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

All Mentions

Indicators of compromise added (2)

Observed by Previdian sensors

Added to the Previdian watchlist

CVE published

CVE ID reserved

Automate this intelligence