What happened

Microsoft says it has reliable evidence of attacks exploiting CVE-2026-65660 in SharePoint Server. The timing matters: Microsoft released a fix in August, so the news is not a previously unknown flaw without a patch. It is confirmation that attackers are using the vulnerability. Microsoft has not disclosed how many organizations were affected or provided details about specific intrusions. Source: Microsoft Security Update Guide

CVE-2026-65660 affects on-premises SharePoint Server. Microsoft describes a network attack in which an attacker with low-level access to the server can trigger code execution. That matters because organizations often use SharePoint to store internal documents and connect business workflows. Confirmation of exploitation does not mean every organization using SharePoint has been breached: exposure depends on the product version, installed updates, and how the server can be reached. Details: SecurityWeek’s report

Why this is in the news now

Microsoft included a fix in its August SharePoint Server updates. Later technical details and new information about attacks changed how defenders should assess the issue. Reporting notes that the vulnerability’s impact includes code execution. Administrators should therefore check the current CVE record and the updates actually installed, rather than relying only on an older internal severity assessment. Source: Current reporting on the fix and revised assessment

This is not a report of an attack against every site using SharePoint Online in Microsoft 365. The reports concern the server product managed by an organization itself, so the first question is whether the organization runs that product. If it uses only the cloud service, these reports alone do not show that its environment is vulnerable. If it runs SharePoint Server, it should establish the version, internet exposure, and update status. Coverage: BleepingComputer’s report on the exploitation warnings

What this means for businesses

SharePoint often supports more than file sharing. Teams use it for internal portals, project material, and business documentation. A compromised server could therefore affect more than one website. A flaw that allows code execution can provide another path into a system, but current reporting does not establish how much data was stolen or what attackers did in each case. It is important to separate confirmed exploitation from unverified claims about its consequences. Source: The Hacker News’ coverage

For an organization running on-premises SharePoint, the practical task is to confirm its status and understand whether suspicious activity occurred. Applying the fix reduces further exposure, but does not replace a review of earlier activity. The following steps are practical suggestions for administrators and security teams; they are not a claim that Microsoft prescribes this exact checklist.

  1. Find out whether you run the affected product. Check your server inventory, SharePoint edition and build, and whether the server is reachable from the internet.
  2. Verify the fix on every server. Compare installed updates with the relevant August package and document any servers still awaiting maintenance.
  3. Look for suspicious activity before the fix was applied. Review sign-ins, web and system logs, unexpected processes, and file changes. If you find indicators, preserve evidence and follow your incident response process.

The key is to connect inventory, patch management, and activity review in one decision: which servers are exposed, which are fixed, and which need further investigation. That gives the organization a concrete view of its own risk instead of a reaction driven only by a headline.

Sources

Information checked on September 27, 2026.