A SharePoint Server vulnerability that Microsoft’s own advisory describes as a moderate spoofing flaw is actually a near-maximum-severity remote code execution bug, according to full technical details a Viettel Cyber Security researcher published this week. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition, and Microsoft’s advisory rates it 6.5 on the CVSS scale and assigns it no impact to integrity or availability. Microsoft’s own CVE record for the same flaw, last updated 11 September, classifies it as remote code execution and rates it 8.8, a gap two internal Microsoft records reflect differently from each other.
For a defender, that mismatch is the actual story. A security team that triages patches by reading the advisory rather than the underlying CVE record would have filed this alongside routine spoofing bugs rather than treating it as a near-critical code-execution issue. Microsoft patched the vulnerability in its August 11 security updates and turned off the vulnerable function by default, so organizations that applied that update are already protected regardless of how the flaw was classified. There is no evidence of exploitation in the wild, and CVE-2026-65660 is not on CISA’s Known Exploited Vulnerabilities catalog.
The original insight worth flagging is that advisory-versus-CVE-record mismatches like this one are a triage risk independent of any single vendor’s process, since most patch-management workflows are built to read one document, not cross-check two. The researcher who found the flaw, Dinh Ho Anh Khoa, previously demonstrated the ToolShell exploit chain against SharePoint at Pwn2Own Berlin in 2025, a chain later weaponized by state-backed groups; CyberTech has tracked the broader pattern of patch-adoption timelines lagging the point at which severity actually becomes clear, and this case shows the lag can start with the vendor’s own paperwork rather than downstream administrators. Security teams running any of the affected SharePoint versions should confirm the August patch is installed and treat the CVE record’s severity rating, not the advisory’s vulnerability-type label, as the operative one going forward, a discipline CyberTech has recommended before when a single Patch Tuesday buries a critical fix among hundreds of routine ones.
