Microsoft misclassified a critical SharePoint Server vulnerability for weeks, initially downplaying it as a spoofing issue when it actually allows authenticated attackers to execute code remotely on affected systems.
The flaw tracked as CVE-2026-65660 impacts SharePoint Server 2016, 2019, and Subscription Edition. Microsoft initially assigned it a CVSS score of 6.5, placing it in the "medium" severity band. Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details revealing the vulnerability enables authenticated remote code execution, a far more dangerous attack vector than spoofing.
The misclassification matters because it shapes how organisations prioritise patching. A 6.5 CVSS score suggests lower urgency than authenticated RCE typically warrants. Organisations running vulnerable SharePoint versions may have deprioritised this patch, leaving systems exposed to attackers with valid credentials.
Authenticated RCE remains one of the highest-value exploits for threat actors. Once an attacker gains initial access through phishing, credential compromise, or insider threats, the ability to execute arbitrary code on SharePoint servers creates a direct path to lateral movement, data exfiltration, and deeper compromise. SharePoint servers often sit in trusted network positions and handle sensitive documents, making them prime targets for post-breach escalation.
The vulnerability affects three major SharePoint versions deployed across enterprises worldwide. SharePoint Server 2016 reached mainstream support end in October 2020 but remains common in legacy environments. SharePoint Server 2019 entered mainstream support until October 2025. Subscription Edition, Microsoft's cloud version of on-premises SharePoint, represents the newer deployment model but still runs the vulnerable code.
Microsoft has released patches, though the timing of the corrected severity assessment remains unclear. Organisations running any of the three affected versions should treat this as a priority patching target regardless of initial CVSS scoring. The authenticated requirement does set a baseline threshold; attackers need valid credentials to exploit the flaw. This does not excuse delayed patching, given how frequently password compromises occur.
The incident highlights a recurring pattern with Microsoft vulnerability disclosures. Initial severity assessments sometimes miss the full exploit chain or underestimate real-world attack scenarios. Researchers publishing technical details force recalibration, but by then defenders have already made patching decisions based on flawed risk models. Microsoft should review its internal processes for evaluating SharePoint vulnerabilities, which occupy a complex threat landscape where privilege escalation and code execution carry outsized impact.
Organisations should verify patching status across all SharePoint deployments immediately. This includes checking servers in maintenance mode or limited-use environments, which often receive lower patching priority. For environments where immediate patching proves difficult, network segmentation, credential management controls, and logging around SharePoint administration activity provide interim defences. Microsoft's updated guidance on CVE-2026-65660 should clarify the correct severity rating and recommended deployment timeline.