MSRC CVE-2026-65660 (August 2026 CSPU) is a SharePoint Server code-injection RCE: an authorized low-privilege attacker can execute code over the network without user interaction. Microsoft scores CVSS 3.1 8.8 Important (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Viettel Cyber Security (Dinh Ho Anh Khoa; technical details amplified 22 Sep 2026) shows the bug in SafeControls/ToolPane Register-directive reconstruction (unescaped quotes → arbitrary .NET class load → XamlServices.Parse webshell) and notes Microsoft’s HTML advisory initially framed it as spoofing/CVSS 6.5 while the CVE record titles RCE.

Affects SharePoint Server 2016, 2019, Subscription Edition (researcher also claims 2013 EOL). August 11 updates fix; can chain with already-patched auth bypass for pre-auth RCE only if that June fix was missed. Distinct from desk CVE-2026-55040 / CVE-2026-63520.

UPDATE 25 Sep 2026: CISA added CVE-2026-65660 to KEV (dateAdded 2026-09-25; federal due date 28 Sep 2026) alongside WSO2/Adobe Magento KEV adds.

UPDATE 27 Sep 2026: SecurityWeek reports Microsoft’s updated advisory states that as of 25 September 2026 Microsoft had reliable evidence of observed attacks exploiting this vulnerability; Previdian (formerly KEVIntel) saw exploitation attempts on 24 Sep and attempts to create a webshell backdoor on 25 Sep, appearing based on Viettel’s technical disclosure.

UPDATE 1 Oct 2026 (desk 13:00 Perth): WA SOC advisory 20261001001 (TLP:CLEAR) restates CVE-2026-65660 (CVSS 8.8 High) as an authenticated low-privilege code-injection RCE on SharePoint Server 2016/2019/Subscription Edition, notes CISA KEV listing, gives the build floors above, links MSRC, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. Primary: MSRC; KEV: CISA; wire: SecurityWeek 27 Sep / BleepingComputer / The Hacker News.