Microsoft Called This SharePoint Bug a Spoofing Issue. It Runs Code.
A vulnerability first rated medium turned out to let logged-in users execute code on the server. The researcher who found it just published the details.
Key points
- CVE-2026-65660 was initially rated as a spoofing flaw with a CVSS score of 6.5, but researcher Dinh Ho Anh Khoa of Viettel Cyber Security has shown it lets a logged-in user run arbitrary code on a SharePoint server.
- The official CVE record was updated to a severity score of 8.8 and reclassified as a code injection bug on 11 August 2026.
- SharePoint Server 2016, 2019 and the Subscription Edition are all affected.
- Microsoft's fix is bundled into the August 2026 SharePoint cumulative update.
Microsoft has quietly upgraded a SharePoint bug from an annoyance to a genuine problem.
When CVE-2026-65660 was first published, it was tagged as a spoofing issue: something that lets an attacker make a request look like it came from a trusted source. CVSS 6.5 is the industry's shorthand for "patch it, but don't panic."
That rating no longer holds. Dinh Ho Anh Khoa at Viettel Cyber Security published his full writeup showing the same bug lets any authenticated user run code of their choosing on the server itself. The Hacker News flagged the reclassification. Since then, the CVE record has been rewritten as code injection at severity 8.8.
What is SharePoint and why does this matter?
SharePoint is Microsoft's server software for company intranets, document libraries and team sites. A server executing code chosen by an attacker is roughly the worst outcome for that kind of system. Once code runs on the box, an intruder can read every document stored there, plant backdoors or move laterally into the rest of the network.
The catch, and it is a real one, is that the attacker needs a valid login first. Random drive-by attacks from the open internet are ruled out. Disgruntled contractors, phished employees whose passwords ended up on criminal forums, or attackers who already have a foothold and want to escalate are not.
How did Microsoft get the rating wrong?
Spoofing and code injection can look similar at first triage. Both involve an input the server trusts more than it should; the difference is what the attacker can do with that trust: forge a message, or hand the server a payload it will execute.
Misclassifications like this are not rare. What is unusual is seeing one flipped this publicly, with the researcher's technical detail forcing the update. We've tracked this pattern across our remote code execution coverage since June 2026, and the lesson is consistent: defenders who deprioritised the August patch on the strength of the original 6.5 score now have a reason to revisit that call.
What should administrators do?
Install the August 2026 SharePoint cumulative update. It resolves CVE-2026-65660 along with other SharePoint and Word vulnerabilities included in that release.
| Detail | Value |
|---|---|
| CVE | CVE-2026-65660 |
| Original rating | Spoofing, CVSS 6.5 |
| Updated rating | Code injection, CVSS 8.8 |
| Affected products | SharePoint Server 2016, 2019, Subscription Edition |
| Fix | August 2026 cumulative update |
Check Microsoft's advisory for any prerequisite updates specific to your farm configuration before deploying.
My read: the interesting story here is not the bug itself, it's the triage. A CVSS score is a starting bid, not a verdict, and this one moved two full points once someone outside Microsoft did the work of chaining a primitive into real code execution. If your patching queue is sorted strictly by initial severity scores, this pattern will keep catching you out.
