CVE-2026-65660, initially classified by Microsoft as a “spoofing” flaw with CVSS 6.5, enables authenticated remote code execution on SharePoint Server, according to technical details published September 22, 2026, by Viettel Cyber Security researcher Dinh Ho Anh Khoa.
The vulnerability affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft has released patches for all affected versions. The discrepancy between Microsoft’s initial classification and the actual exploit impact underscores the severity gap that can emerge when vendor assessments do not fully capture a vulnerability’s real-world exploitability.
Microsoft Initially Classified CVE-2026-65660 as Spoofing, CVSS 6.5
Microsoft’s original advisory for CVE-2026-65660 categorized the flaw as a spoofing vulnerability and assigned a CVSS base score of 6.5, a medium-severity rating. Spoofing vulnerabilities typically involve presentation layer flaws where an attacker can impersonate a trusted entity or manipulate displayed content, but not achieve code execution or direct system compromise.
The 6.5 severity score suggested the vulnerability posed moderate risk, likely leading some organizations to deprioritize patching in favor of higher-severity flaws disclosed in the same patch cycle.
Viettel Researcher Demonstrates Authenticated Remote Code Execution
Dinh Ho Anh Khoa of Viettel Cyber Security published full technical details on September 22, 2026, demonstrating that CVE-2026-65660 enables authenticated remote code execution on SharePoint Server. The researcher’s analysis shows the flaw allows an authenticated user to execute arbitrary code on the SharePoint server, not merely spoof content or impersonate users.
Authenticated RCE means an attacker with valid SharePoint credentials can run code on the server hosting SharePoint services. The authentication requirement does not eliminate the risk—many SharePoint deployments grant access to broad user populations, including external partners, contractors, or federated identities from less-trusted domains.
Once an attacker achieves code execution on the SharePoint server, they can access SharePoint databases, extract document libraries, modify permissions, install backdoors, or pivot to other systems on the network. The impact extends far beyond content spoofing.
Severity Discrepancy Between Vendor Assessment and Researcher Findings
The gap between Microsoft’s “spoofing” classification and the researcher’s demonstration of remote code execution reflects a recurring challenge in vulnerability disclosure. Vendors may classify vulnerabilities based on their initial understanding of the flaw, which may not account for all exploitation techniques or attack chains.
Viettel Cyber Security’s analysis revealed exploitation paths Microsoft’s advisory did not reflect. Whether Microsoft was unaware of the RCE capability, assessed it as requiring impractical preconditions, or classified the flaw conservatively pending further analysis is unclear from the public record.
For defenders, the discrepancy creates confusion. Organizations that triage patches based on CVSS scores and vulnerability types may have delayed applying the CVE-2026-65660 fix, assuming a medium-severity spoofing flaw could wait while critical RCE vulnerabilities received immediate attention. The researcher’s disclosure reframes the risk.
Microsoft Patches Available for SharePoint 2016, 2019, Subscription Edition
Microsoft released patches for CVE-2026-65660 covering SharePoint Server 2016, 2019, and Subscription Edition. Organizations running any of these versions should prioritize patching given the authenticated RCE capability documented by Viettel Cyber Security.
The patch availability predates the researcher’s full disclosure, meaning organizations that applied Microsoft’s updates before the RCE details became public are already protected. Organizations that deferred patching based on the spoofing classification now face a higher-urgency remediation task.
Organizations Should Re-Prioritize CVE-2026-65660 Patching
SharePoint administrators should re-evaluate CVE-2026-65660’s priority in their patch queues. The authenticated RCE capability elevates the flaw above typical medium-severity spoofing issues, particularly in environments where SharePoint is accessible to large user populations or external partners.
Organizations that have not yet patched should apply the fix immediately. Those that did patch should verify deployment across all SharePoint servers, as partial patching leaves exposure in mixed-version environments or missed instances.
After patching, organizations should review SharePoint server logs for authenticated activity that could indicate exploitation attempts during the exposure window. Look for unusual file uploads, privilege escalation attempts, or code execution artifacts tied to user accounts that would have the authenticated access required to exploit CVE-2026-65660.
Implications for Vendor Vulnerability Classification and Defender Prioritization
The CVE-2026-65660 case illustrates the risk of relying solely on vendor-assigned CVSS scores and vulnerability type labels for patch prioritization. Independent researchers sometimes discover exploitation techniques vendors did not anticipate or document in their advisories.
Organizations should treat “spoofing” classifications with caution when the affected product handles authentication, authorization, or server-side data processing. A spoofing flaw in a web application or collaboration platform may mask deeper code execution or data access risks not immediately apparent from the vulnerability type alone.
The authenticated nature of CVE-2026-65660 does not eliminate the threat. SharePoint deployments with hundreds or thousands of users, external partner access, or federated authentication from less-trusted identity providers face realistic scenarios where an attacker could obtain valid credentials and exploit the flaw.
Viettel Cyber Security’s disclosure also serves as a reminder that vulnerability severity is not static. A flaw initially assessed as moderate-severity spoofing can become high-severity RCE once researchers publish detailed exploitation techniques. Defenders cannot assume vendor advisories represent the final word on a vulnerability’s real-world impact.
