# SharePoint Bug Patched in August Is Now Exploited in Attacks

Page: https://hirantha.me/blog/sharepoint-bug-patched-in-august-is-now-exploited-in-attacks
Published: 2026-09-30
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: sharepoint, cve-2026-65660, remote code execution, cisa kev, patch management

> CVE-2026-65660 lets a low-privilege user run code on SharePoint Server; attacks began 24 September and CISA set a 28 September patch deadline.

A SharePoint Server bug that Microsoft first filed as a low-grade spoofing issue is now being used in real attacks. Patches have been available since August, so the exposed servers are the ones that never received them.

## What is being exploited

The flaw is tracked as CVE-2026-65660 (CVE stands for Common Vulnerabilities and Exposures). It affects on-premises SharePoint Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. SharePoint Online is not part of the picture.

Microsoft shipped the fix on 11 August 2026 in its monthly security update and rated it as spoofing with a CVSS (Common Vulnerability Scoring System) score of 6.5. On 27 August it revised the entry to remote code execution and raised the score to 8.8, according to the security firm Previdian. A low score on the original listing may have led some administrators to defer the update.

An attacker needs a valid low-privilege account on the target. Per SecurityWeek, turning the bug into unauthenticated remote code execution requires chaining it with a separate authentication bypass.

## How the bug works

The problem sits in SharePoint's SafeControls list, the allow-list that decides which server-side .NET types a page may instantiate. A quote-injection flaw lets an attacker slip past that check and choose which type gets created. From there, the exploit reaches .NET's XAML (Extensible Application Markup Language) parser and ends in code execution on the server.

## What defenders have seen so far

Previdian runs a SharePoint honeypot, and on 24 September 2026 it recorded 12 exploitation requests from a single source address. The requests hit two page paths, AddGallery.aspx and designgallery.aspx, and carried no credentials.

The attack came in two stages:

1. A first payload of about 7.8 KB switched off a .NET deserialization safeguard.
2. A second payload of about 535 KB delivered a loader that decrypts an embedded assembly with AES (Advanced Encryption Standard) and loads it into memory. Previdian did not recover the final payload.

On 25 September it saw attempts to create a web shell at `/_layouts/15/sphealth.aspx`. Microsoft updated its advisory the same day to say it had reliable evidence of attacks, and CISA (the US Cybersecurity and Infrastructure Security Agency) added the bug to its Known Exploited Vulnerabilities catalog with a deadline of 28 September for federal agencies.

Timing matters here. SecurityWeek reported exploitation began roughly six weeks after the patch and a couple of days after Viettel Security published technical details. The attacks look built from that write-up, which is the usual pattern once a public analysis exists.

## Discrepancies worth knowing about

Reports differ slightly on volume. The Hacker News cites Previdian telemetry of 16 attempts on 24 September from addresses in the UK and Israel, while Previdian's own write-up counts 12 requests from one address, AS212238, which belongs to the hosting provider Datacamp. The sources do not explain the gap, so treat the exact count as approximate. What is consistent is the date, the two-stage pattern and the web shell name.

## Indicators to check for

Previdian published these markers from its capture:

- Source IP address 169.150.248.21
- An assembly named `wt3k3sij.dll` and a loader type called `SdLoader`
- A form field value of `http://asdf/_controltemplates/15/AclEditor.ascx`
- The file `sphealth.aspx` under the `_layouts/15` directory

## A second patch may be needed

Previdian points out that two separate fixes matter. One is the August update for this flaw. The other is a June 2026 update that closed an anonymous-delivery weakness. Sites that permit anonymous access and lack the June fix give attackers a way to reach the vulnerable code without an account. Being current on August alone may not be enough.

## What this means in practice

- Confirm that every on-premises SharePoint server carries both the June and August 2026 updates, not just the latest one.
- Search web server logs for POST requests to the two gallery pages with the `DisplayMode=Edit` query string, and look for the web shell file.
- Treat any hit as a full compromise: rotate machine keys and service credentials, and rebuild rather than clean where possible.
- Reduce exposure by limiting who can reach SharePoint from the internet and by reviewing anonymous access settings.
- Do not rely on the original severity label when prioritising. Microsoft's own rating changed after release.

CISA's catalog now lists 16 SharePoint vulnerabilities, eight of them found and patched this year, according to SecurityWeek. That pace makes a routine, fast patch cycle for SharePoint a practical necessity rather than a nicety.

## Questions

**Which SharePoint versions are affected by CVE-2026-65660?**
On-premises SharePoint Server 2016, 2019 and Subscription Edition, per Previdian. The fix shipped in Microsoft's August 2026 security update.

**Does CVE-2026-65660 need a login to exploit?**
It needs a low-privilege account by itself. SecurityWeek reports unauthenticated code execution requires chaining it with a separate authentication bypass.

**How do I know if my SharePoint server was attacked?**
Look for a file named sphealth.aspx under _layouts/15, POST requests to AddGallery.aspx or designgallery.aspx, and the indicators Previdian published.

**Is the August update enough to be protected?**
Previdian says a June 2026 update for an anonymous-delivery weakness is also needed, so both updates should be installed.

## Sources

- [Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks](https://www.securityweek.com/microsoft-sharepoint-flaw-cve-2026-65660-now-exploited-in-attacks/), SecurityWeek
- [CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts](https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/), Previdian
- [SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild](https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html), The Hacker News