TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1104-20Exploited in the wild
SharePoint RCE (CVE-2026-65660): the “spoofing” flaw that was really code execution
Microsoft first described this SharePoint flaw as spoofing at CVSS 6.5. It is a code injection that lets a low-privileged authenticated user run code on the server, re-scored 8.8, now exploited to drop webshells and listed in CISA KEV. Teams that triaged it off the original label under-prioritized it. Patch the August update, then confirm the fix and hunt for webshells.
SEVERITY
High
PEAK CVSS
8.8
AUTH REQUIRED
Low priv
PUBLIC POC
Reported
PUBLISHED
Nov 4, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
A low-severity ticket is where real incidents hide. This one said “spoofing, 6.5, moderate.” Teams triaged it down and moved on. It was remote code execution the whole time.
CVE-2026-65660 is a code-injection flaw in SharePoint Server. Microsoft’s advisory called it spoofing and assigned no impact to integrity or availability, so dashboards showed a yellow. Then a researcher published the technical detail: a low-privileged authenticated user can execute code on the server. The CVE record now reads remote code execution at 8.8, attackers are dropping webshells, and on servers that allow anonymous access it can be chained toward pre-auth execution.
SharePoint is where the sensitive documents live, and it usually trusts the same identity provider as everything else, so a foothold there reaches far. The deeper lesson is about triage itself: when prioritization keys only on a vendor’s severity label, a mislabeled flaw walks straight past it. The flaws that burn you are rarely the ones you ranked highest. They are the ones a number told you to ignore. That is the gap validation exists to close: not what the label says, but what an attacker can actually do here.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a SharePoint Server code-injection flaw that Microsoft originally labeled as spoofing at CVSS 6.5. Published technical analysis showed it is authenticated remote code execution, and the CVE record now reads 8.8. It is exploited in the wild to drop webshells, and CISA added it to KEV. The real risk is twofold: code execution on a document-rich, identity-connected server, and a triage trap, since the original label led many teams to deprioritize the patch.
KEY JUDGMENTS
01
CISA added CVE-2026-65660 to its KEV catalog on Sep 25, 2026 after confirmed exploitation, and researchers reported two-stage attacks dropping webshells about 17 days after the patch.Observed
02
Microsoft first classed it spoofing (6.5); the CVE record and NVD now describe remote code execution (8.8). Teams that keyed triage on the original label under-prioritized it.Assessed
03
It requires a low-privileged authenticated account, but on servers configured for anonymous access it can be chained toward pre-authentication execution.Reproduced
04
SharePoint concentrates sensitive documents and usually shares the enterprise identity provider, so server code execution is a broad foothold, not a contained one.Assessed
CWE-94 improper control of generation of code (code injection)
Original label
Spoofing, CVSS 6.5 (re-scored to RCE, 8.8)
Access needed
Authenticated, low privilege; chainable where anonymous access is allowed
Affected
SharePoint Enterprise Server 2016, Server 2019, Subscription Edition
Scoring
8.8 · CVSS v3.1 (current)
Fix
August 2026 security updates
EXPOSURE: ON-PREM SHAREPOINT, BELOW THE FIX
01On-prem SharePoint2016, 2019 or Subscription Edition.
02Below the August fixNot yet on the August 2026 security build.
03An account to abuseA low-privileged authenticated user; worse with anonymous access.
04Triaged off the labelDeprioritized as 'spoofing 6.5' and never patched.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedKEV Sep 25; webshells seen.
LABELWas 'spoofing'Re-scored to RCE, 8.8.
CHAINABLETo pre-authWhere anonymous access is on.
PATCHAvailableAugust 2026 updates.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Aug 11Microsoft ships the fix in the August 2026 updates, describing the flaw as spoofing at CVSS 6.5.
Sep (mid)A researcher publishes technical detail showing authenticated RCE; NVD scores it 8.8 and the CVE record is retitled remote code execution.
Sep 25CISA adds CVE-2026-65660 to KEV with a short federal deadline; two-stage webshell attacks are reported.
04 · AFFECTED PRODUCTS
Affected and fixed versions
This is on-premises SharePoint Server. SharePoint Online is operated by Microsoft. Confirm the exact fixed build per edition against Microsoft’s advisory.
PRODUCT
AFFECTED
FIXED IN
STATUS
SharePoint Subscription Edition
before Aug 2026 build
August 2026 security update
Fixed
SharePoint Server 2019
before Aug 2026 build
August 2026 security update
Fixed
SharePoint Enterprise Server 2016
before Aug 2026 build
August 2026 security update
Fixed
SharePoint Online
not applicable
operated by Microsoft
Not applicable
THE TRIAGE TRAPIf your prioritization keyed on the original "spoofing, 6.5" label, this patch may have been deferred. Re-check every on-prem farm against the August build regardless of how it was first ranked.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
On-prem farms not on the August buildApply the August 2026 security update now. Exploitation and webshells are confirmed.
Internet-facing or anonymous-access farmsHighest priority: these enable chaining toward pre-authentication execution.
HighWithin 72 hours
Any farm exposed while unpatchedHunt for webshells and unexpected files; the patch does not remove them.
Identity integrationReview SSO trust so a SharePoint compromise does not pivot outward.
Low-privilege accountsReview who holds authenticated access, since that is all the flaw needs.
HighBefore closing
Every farmRecord the build, the compromise-check result and any secret rotation as evidence.
WORKAROUNDS
Patch is the fix. Apply the August 2026 updates. No configuration change removes the code-injection path.Reduce anonymous access. Disable anonymous access where it is not required to break the pre-auth chain.Hunt before trusting. Check exposed farms for webshells and modified files before declaring them clean.Review identity trust. Tighten SSO and service-account trust so a foothold does not spread.
06 · DETECTION AND HUNTING
Observables and hunting queries
Hunt on the build version, on webshell artifacts in SharePoint web directories, and on the two-stage activity researchers have described.
TYPE
OBSERVABLE
SOURCE
Exposure
A farm build below the August 2026 security update
SharePoint admin center, Get-SPFarm
Behavior
New or modified .aspx or script files in SharePoint web roots
File integrity, LAYOUTS and web app directories
Behavior
w3wp worker process spawning a command interpreter
EDR, process telemetry
EXPOSURE · CVE-2026-65660farm build version
Get-SPFarm | Select BuildVersion
HUNT · CVE-2026-65660worker spawning a shell
# EDR: w3wp.exe -> cmd.exe / powershell.exe on SharePoint servers
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Persistence
T1505.003
Server Software Component: Web Shell
Observed
08 · TECHNICAL ANALYSIS
Root cause and attack path
CVE-2026-65660 is a code-injection flaw (CWE-94) in SharePoint Server. Microsoft’s initial advisory classified it as a spoofing issue with a CVSS of 6.5 and assigned no impact to integrity or availability, which is how it appeared in most prioritization tools. Independent technical analysis then demonstrated that a low-privileged authenticated user can use it to execute code on the server. The CVE record published separately was updated to title the same flaw a remote code execution vulnerability, and NVD scores it 8.8. Both records assign CWE-94.
The gap between the two descriptions is the story. A defender who triaged on the vendor advisory saw a moderate spoofing bug; the reality was server-side RCE on a system that holds sensitive documents and typically shares the organization’s identity provider. On farms configured for anonymous access, researchers note the flaw can be chained toward pre-authentication execution. Exploitation followed quickly, with two-stage attacks dropping webshells roughly 17 days after the patch, which is why CISA’s KEV listing, not the original score, is the signal to act on.
01 ACCESS
A low-privileged authenticated session, or anonymous access
Control: Reduce anonymous access; review accounts
02 INJECT
Crafted input triggers code generation on the server
An earlier exploited SharePoint deserialization RCE. Shows the platform’s repeated targeting.
AssessedThe flaws that burn you are rarely the ones you ranked highest. A mislabeled 6.5 that is really an exploited 8.8 is exactly why triage needs validation, not just a vendor’s number.
09 · VALIDATION
Confirm remediation
A severity label is not a verdict, and a build number alone is not either after confirmed exploitation. Each farm should end with evidence: patched, checked for webshells, and reviewed.
01
Confirm the farm build
Across every on-prem farm, regardless of how the flaw was first triaged.
Get-SPFarm | Select BuildVersion
02
Compare against the August build
Match to Microsoft’s fixed build for the edition.
# compare BuildVersion to the August 2026 security update for your edition
03
Check anonymous access
Anonymous access widens this to a pre-auth chain.
# review web application and site anonymous access settings
04
Hunt for webshells
Review SharePoint web roots for new or modified script files.
# inspect LAYOUTS and web app directories for unexpected .aspx / script files
05
Review identity trust
Confirm SSO and service-account trust would not let a foothold spread.
# review SSO trust and SharePoint service account privileges
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-65660
01Do you run on-prem SharePoint Server (2016, 2019, or Subscription Edition)?
02Is any farm below the August 2026 security build, including ones first triaged as low severity?
03Do any farms allow anonymous access, enabling a pre-auth chain?
04If a farm was exposed while unpatched, have you hunted for webshells and reviewed it?
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-65660 being exploited?
Yes. CISA added it to KEV on September 25, 2026, and researchers reported two-stage attacks dropping webshells roughly 17 days after the patch.
Why was it listed as spoofing?
Microsoft’s initial advisory classed it as spoofing at CVSS 6.5. Published analysis showed authenticated code execution, and the CVE record and NVD now describe it as remote code execution at 8.8.
Which versions are affected?
On-prem SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition. SharePoint Online is not applicable.
Does patching make a farm safe?
Patch, then hunt for webshells on any farm that was reachable while unpatched; the update does not remove what was already dropped.
VALIDATE YOUR EXPOSURE
Prove your SharePoint exposure
Hayrok inventories your on-prem SharePoint farms, confirms the fixed build regardless of how the flaw was first triaged, and tests for the anonymous-access path that enables chaining. Every result lands in Evidence Fabric.