A SharePoint Server bug that Microsoft first filed as a low-grade spoofing issue is now being used in real attacks. Patches have been available since August, so the exposed servers are the ones that never received them.
What is being exploited
The flaw is tracked as CVE-2026-65660 (CVE stands for Common Vulnerabilities and Exposures). It affects on-premises SharePoint Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. SharePoint Online is not part of the picture.
Microsoft shipped the fix on 11 August 2026 in its monthly security update and rated it as spoofing with a CVSS (Common Vulnerability Scoring System) score of 6.5. On 27 August it revised the entry to remote code execution and raised the score to 8.8, according to the security firm Previdian. A low score on the original listing may have led some administrators to defer the update.
An attacker needs a valid low-privilege account on the target. Per SecurityWeek, turning the bug into unauthenticated remote code execution requires chaining it with a separate authentication bypass.
How the bug works
The problem sits in SharePoint's SafeControls list, the allow-list that decides which server-side .NET types a page may instantiate. A quote-injection flaw lets an attacker slip past that check and choose which type gets created. From there, the exploit reaches .NET's XAML (Extensible Application Markup Language) parser and ends in code execution on the server.
What defenders have seen so far
Previdian runs a SharePoint honeypot, and on 24 September 2026 it recorded 12 exploitation requests from a single source address. The requests hit two page paths, AddGallery.aspx and designgallery.aspx, and carried no credentials.
The attack came in two stages:
- A first payload of about 7.8 KB switched off a .NET deserialization safeguard.
- A second payload of about 535 KB delivered a loader that decrypts an embedded assembly with AES (Advanced Encryption Standard) and loads it into memory. Previdian did not recover the final payload.
On 25 September it saw attempts to create a web shell at /_layouts/15/sphealth.aspx. Microsoft updated its advisory the same day to say it had reliable evidence of attacks, and CISA (the US Cybersecurity and Infrastructure Security Agency) added the bug to its Known Exploited Vulnerabilities catalog with a deadline of 28 September for federal agencies.
Timing matters here. SecurityWeek reported exploitation began roughly six weeks after the patch and a couple of days after Viettel Security published technical details. The attacks look built from that write-up, which is the usual pattern once a public analysis exists.
Discrepancies worth knowing about
Reports differ slightly on volume. The Hacker News cites Previdian telemetry of 16 attempts on 24 September from addresses in the UK and Israel, while Previdian's own write-up counts 12 requests from one address, AS212238, which belongs to the hosting provider Datacamp. The sources do not explain the gap, so treat the exact count as approximate. What is consistent is the date, the two-stage pattern and the web shell name.
Indicators to check for
Previdian published these markers from its capture:
- Source IP address 169.150.248.21
- An assembly named
wt3k3sij.dlland a loader type calledSdLoader - A form field value of
http://asdf/_controltemplates/15/AclEditor.ascx - The file
sphealth.aspxunder the_layouts/15directory
A second patch may be needed
Previdian points out that two separate fixes matter. One is the August update for this flaw. The other is a June 2026 update that closed an anonymous-delivery weakness. Sites that permit anonymous access and lack the June fix give attackers a way to reach the vulnerable code without an account. Being current on August alone may not be enough.
What this means in practice
- Confirm that every on-premises SharePoint server carries both the June and August 2026 updates, not just the latest one.
- Search web server logs for POST requests to the two gallery pages with the
DisplayMode=Editquery string, and look for the web shell file. - Treat any hit as a full compromise: rotate machine keys and service credentials, and rebuild rather than clean where possible.
- Reduce exposure by limiting who can reach SharePoint from the internet and by reviewing anonymous access settings.
- Do not rely on the original severity label when prioritising. Microsoft's own rating changed after release.
CISA's catalog now lists 16 SharePoint vulnerabilities, eight of them found and patched this year, according to SecurityWeek. That pace makes a routine, fast patch cycle for SharePoint a practical necessity rather than a nicety.
