Actively exploited SharePoint flaw CVE-2026-65660 passes CISA's 28 September federal patch deadline
A fix that sat available for about six weeks before exploitation was confirmed shows the cost of letting patches age in the backlog. The authentication requirement limits the risk less than it seems, because stolen or low-privilege credentials are common in enterprise environments. On-premises SharePoint estates that did not apply the August update should be patched and reviewed for signs of misuse.
What Happened
CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 25 September 2026 and set 28 September 2026 as the remediation deadline for US federal civilian executive branch agencies. Microsoft had shipped the fix on 11 August 2026 in that month's Patch Tuesday cycle. Current technical analysis says exploitation requires an authenticated attacker with low-privilege access to the SharePoint server.
Why It Matters
A fix that sat available for about six weeks before exploitation was confirmed shows the cost of letting patches age in the backlog. The authentication requirement limits the risk less than it seems, because stolen or low-privilege credentials are common in enterprise environments. On-premises SharePoint estates that did not apply the August update should be patched and reviewed for signs of misuse.
Sources
- CISA (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-25)
- Microsoft Security Response Center (opens in a new tab): CVE-2026-65660: Microsoft SharePoint Server Remote Code Execution Vulnerability (2026-08-11)
More From This Briefing
- CISA adds two actively exploited critical Citrix NetScaler flaws to KEV; federal deadline 30 September
- Anthropic releases Claude Sonnet 5.5 at unchanged API prices, adding cyber safeguards to its mid-tier model
- New estimate puts US data centre and AI infrastructure investment at $10.3 trillion from 2025 to 2032
- CISA discontinues its weekly Vulnerability Bulletin as of 28 September in shift to risk-based prioritisation
This story is part of the Laurenceo Intelligence briefing for 29 September 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.