SharePoint CVE-2026-65660 Exploitation Begins 24 Hours After Viettel Disclosure

The vulnerability is an authenticated type-check bypass that yields code execution at low privilege levels. Chaining with a separate authentication bypass produces unauthenticated remote code execution. CISA added it to the KEV catalog on September 25 with a three-day federal patching deadline of September 28. Sixteen SharePoint vulnerabilities now sit in the catalog eight of them disclosed and added this year.

Previdian telemetry shows the first in-the-wild attempts on September 24 followed by confirmed webshell installation the next day. The observed payloads match the proof-of-concept released by Viettel Security whose researchers had initially reported the issue to Microsoft. Microsoft had first rated the flaw medium-severity spoofing before reclassifying it high-severity RCE.

SharePoint instances underpin document workflows and intranet services across state and local election offices. Persistent under-patching of this platform creates durable footholds that survive election cycles. The pattern of rapid post-disclosure exploitation combined with the volume of KEV-listed SharePoint flaws indicates that federal and contractor networks remain structurally exposed.

Contract award records show continued procurement of SharePoint-based collaboration platforms without mandatory independent verification of patch cadence. Expect follow-on campaigns to target chained authentication bypasses in the same environments once initial access is established.