Microsoft SharePoint Server Flaw Reclassified: Authenticated Remote Code Execution Confirmed

On September 22, 2026, Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details regarding a SharePoint Server vulnerability identified as CVE-2026-65660. Initially, Microsoft had classified the flaw as a spoofing vulnerability with a CVSS score of 6.5. However, the researcher's analysis demonstrates that the vulnerability actually enables authenticated remote code execution (RCE).

The flaw affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. According to the researcher, the vulnerability allows attackers who possess valid domain credentials to execute arbitrary code on affected SharePoint Server instances. This reclassification significantly raises the severity of the issue, as spoofing vulnerabilities typically involve deception rather than direct system compromise.

Microsoft has acknowledged the issue and released security updates to address the flaw. The company's security advisory should be consulted for definitive patch guidance. Viettel Cyber Security's write-up details the technical mechanics of the vulnerability, though specific exploitation code has not been independently verified in the wild.

Organizations running unpatched SharePoint Server 2016, 2019, or Subscription Edition are at risk of unauthorized code execution by attackers with valid credentials. The initial misclassification as a spoofing flaw may have delayed patching efforts, underscoring the importance of thorough vulnerability analysis.