CISA Gives Agencies 3 Days to Patch an Exploited SharePoint Bug
Security / news
CISA Gives Agencies 3 Days to Patch an Exploited SharePoint Bug
Microsoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
CISA added a Microsoft SharePoint flaw to its Known Exploited Vulnerabilities catalog on Sept. 25, giving federal agencies until Sept. 28 to patch a bug already under attack. The deadline runs under Binding Operational Directive 26-04, which requires civilian agencies to prioritize remediation of flaws CISA judges high-risk on publicly exposed systems.
The bug, CVE-2026-65660, is a code injection flaw in Microsoft Office SharePoint, tracked under CWE-94, that lets an attacker who already has edit access to a site reach arbitrary code execution on the server underneath it. It carries a CVSS 3.1 score of 8.8 and affects SharePoint Server 2016, 2019 and Subscription Edition, the on-premises product line rather than SharePoint Online.
The score understates what shipped on Aug. 11
Microsoft's Aug. 11 Patch Tuesday release fixed the underlying code path, but the advisory that accompanied it described CVE-2026-65660 as a spoofing issue with no impact to confidentiality or availability, rated 6.5. Administrators who triage by severity had no reason to prioritize it over the dozens of other bugs in the same batch.
That changed on Aug. 27, when Microsoft revised the advisory and the CVE record to reflect remote code execution instead of spoofing, raising the score to 8.8. The fix itself did not change between the two dates. What changed was Microsoft's own understanding of what the bug allowed an attacker to do, 16 days after it had already shipped a patch for it.
The same pattern of a deadline landing days after CISA quietly revises its own risk math shows up in CISA's 3-Day Linux Kernel Deadline Hid a Scoring Fight, where the agency's own severity numbers disagreed with the vendor's.
Timeline
| Date | Event |
|---|---|
| Aug. 11, 2026 | Patch ships; advisory rates it spoofing, CVSS 6.5 |
| Aug. 27, 2026 | Microsoft reclassifies it as RCE, CVSS 8.8 |
| Sept. 24, 2026 | Previdian's honeypot logs the first exploitation attempt |
| Sept. 25, 2026 | CISA adds CVE-2026-65660 to its KEV catalog |
| Sept. 28, 2026 | Federal patch deadline under BOD 26-04 |
What the honeypot caught
Previdian founder Ryan Dewhurst wrote in a blog post that his firm's honeypot recorded 12 POST requests against a SharePoint installation at around 12:00 UTC on Sept. 24, all from a single address, 169.150.248.21, registered to the Netherlands-based hosting network Datacamp Limited under autonomous system 212238. Microsoft's own advisory, cited by The Hacker News, said the company "had reliable evidence of observed attacks against exploitation of this vulnerability" as of Sept. 25, without naming the attacker, the number of organizations affected, or what happened after a successful compromise.
The payload Previdian captured arrives in two stages. A 7,834-byte first stage disables .NET's deserialization protections using an ActivitySurrogateDisableTypeCheck gadget, clearing the way for arbitrary types to be instantiated. A second, 535,404-byte stage then loads an encrypted assembly loader Previdian calls SdLoader, shipped inside a file named wt3k3sij.dll, which decrypts and runs further code on the compromised server.
The bug this one needs to matter
CVE-2026-65660 alone requires an attacker to already have edit access to a SharePoint site, which is a real precondition rather than a formality. Previdian's writeup ties the observed attacks to a second, unrelated bug Microsoft fixed on June 9: a WebPartPage left in edit mode lets an unauthenticated visitor reach ToolPane processing on any site that permits anonymous viewing, which supplies the access CVE-2026-65660 needs. Chained together, the two bugs let an attacker with no credentials at all reach code execution on an internet-facing SharePoint server.
What to do now
SharePoint Server 2016, 2019 and Subscription Edition administrators who applied the Aug. 11 update are already patched against CVE-2026-65660, whatever severity Microsoft's advisory carried that day. Anyone who deferred it because the advisory said spoofing should treat that decision as reversed and check server logs for POST requests carrying a wt3k3sij.dll payload or unexplained ToolPane activity on anonymous-access sites. CISA has not published guidance beyond the Sept. 28 remediation deadline, and neither Previdian nor Microsoft's advisory has said how many servers have been compromised. The pattern of a rushed federal deadline following a slow public accounting of severity is not new to this beat; Adobe Patches Actively Exploited Commerce Zero-Day covered the same gap on a different platform earlier this month.
Sources
More in Security
- 01CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 02OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 03CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.
- 04ShinyHunters Claims a PeopleSoft Zero-Day Breached the FBIThe extortion group says it took 2 to 3 terabytes of personnel data on the night of Sept. 21, but the bureau has confirmed only that it is investigating a claim.