Microsoft called the SharePoint bug spoofing. The write-up says code execution.

Microsoft's August advisory for CVE-2026-65660 called it spoofing and scored it 6.5. Their own CVE record, updated September 11, calls the same bug remote code execution. NVD sits at 8.8. Today Viettel's Dinh Ho Anh Khoa published the full write-up. The patch has been sitting in the August 11 SharePoint updates since mid-August. Shops that triaged the advisory and filed it under "phishing lookalike, later" now have public details and a researcher who says he has used it on engagements. The label on the bulletin was the problem.

What changed this morning

The product is SharePoint Server 2016, 2019, and Subscription Edition. An authenticated user is enough for the path Khoa describes. He also showed a chain to pre-authentication code execution on servers that still allow anonymous page access and never took a June 9 authentication-bypass fix. Servers that took June are off that pre-auth path. August 11 is the fix for 65660 itself. Khoa says the August update also turns the vulnerable function off by default.

No one has reported this CVE in the wild. It is not on CISA's exploited list. Microsoft still rates exploitation as unlikely. The markup is public as of today. That is the usual Tuesday gap: not KEV, not theoretical either. Khoa is the researcher who showed ToolShell at Pwn2Own Berlin in 2025. That chain did get used. This one has not, in the reporting we have. Treat the August patch as late, not optional.

He says SharePoint 2013 is affected too. Microsoft's advisory lists 2016 and up. 2013 left support in April 2023. There will not be a bulletin for it. If you still have 2013 on a VLAN because a line-of-business app "needs it," that is a replace conversation, not a wait-for-Microsoft conversation.

Why the label matters in a small shop

A lot of Alberta offices still run on-prem SharePoint because migration keeps slipping. The person who reads Patch Tuesday often sorts by the short title. "Spoofing, 6.5" loses to a 9.8 on the same day. The CVE record and the NVD score were already louder than the advisory. Today's paper just made the gap impossible to miss. We are not going to recap the technique. The useful fact is the date: August 11. If WSUS says those KBs are in, confirm on a server, not on a spreadsheet.

What we would check today

• SharePoint 2016, 2019, Subscription Edition: confirm the August 11 security updates are actually installed. If the farm missed June 9 as well, you are on the worse path until both are on.
• SharePoint 2013: plan the exit. There is no patch coming.
• Anonymous access on a page that should not have it is a finding even without this CVE. Turn it off if the business does not need it.
• Do not paste a public proof onto a production farm to "validate." The advisory mismatch is the reason to patch, not a lab on the file server.

Bottom line

Spoofing on the bulletin and code execution on the CVE is how a farm stays open for five weeks. Forensic Five will ask which SharePoint build you are on and whether August actually landed. From St. Albert, Alberta. Install the August updates. Then go look at the VeloCloud and the GS1900, because those two are already being used.