A Months-Old SharePoint Flaw Is Now Under Attack: Your Questions Answered
A SharePoint Server bug that Microsoft patched in August turned out to be worse than first described, and attackers are now trying to use it. Here are the questions owners are asking.
A SharePoint weakness that looked minor when Microsoft fixed it in August has since been reclassified as something far more serious, and criminals have started probing for it. We have put the key points in question-and-answer form for owners who want the practical picture without the jargon.
What exactly is the problem?
The flaw, tracked as CVE-2026-65660, lives in the way SharePoint handles web parts, the building blocks that add features to SharePoint pages. Researchers showed that someone signed in with a basic, low-privilege account can trick the server into loading components it should have blocked, and from there run their own code on the server.
Wasn’t this already fixed?
The patch exists. Microsoft shipped it on August 11, 2026, but at that point described the bug as a spoofing issue with a medium severity score of 6.5. Later analysis showed it could lead to code execution, and the National Vulnerability Database raised the score to 8.8. Any server that has not installed that update remains exposed.
Which systems are affected?
Only self-hosted SharePoint: SharePoint Server 2016, 2019 and Subscription Edition. SharePoint Online, the version included with Microsoft 365, is not listed as affected.
Do attackers need a password first?
Technically yes, but Field Effect cautions that this is a thinner shield than it sounds. Stolen, guessed or phished credentials can be enough. Researchers also demonstrated a way to remove the login requirement entirely on servers that allowed anonymous page access and had not installed an earlier, separate fix.
Is anyone really using it?
Yes. Proof-of-concept code went public on September 22, and monitoring firms reported exploitation attempts within days. On September 25 the U.S. cybersecurity agency CISA added the flaw to its catalog of known exploited vulnerabilities.
Why is a SharePoint break-in such a big deal?
SharePoint often holds contracts, financial records, project files and other sensitive material, and it usually connects to identity systems, databases and other business tools. A compromised server can therefore open doors well beyond SharePoint itself. The researchers’ demonstration also used a web shell that lives in the server’s memory instead of on disk, which leaves fewer traces for investigators to find.
Where that leaves your company
If your team uses SharePoint only through Microsoft 365, this one does not appear to concern you. If you run a SharePoint server yourself, treat it as urgent:
- Confirm the updates are in. The August 2026 security updates should be installed, and the June 2026 updates should be present too, since they close the earlier gap that lets attackers skip the login.
- Trim who and what can reach it. Remove accounts that no longer need access, review any setting that allows anonymous pages, and put the server behind a VPN or similar control rather than exposing it directly to the internet.
- Have someone look for signs of trouble. Field Effect suggests watching for unusual programs launched by the SharePoint web process (w3wp.exe), PowerShell or command-shell activity, and unexpected outbound connections from the server. Ask your IT provider whether that monitoring is in place.
Need help getting SharePoint patched and monitored? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
Details here come from Field Effect’s security write-up on the SharePoint flaw.
About The Author
