SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

A vulnerability in SharePoint Server, initially thought to be a spoofing flaw, has been found to actually enable authenticated remote code execution. Microsoft initially assigned a CVSS score of 6.5 to the vulnerability. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition. A researcher from Viettel Cyber Security has published full technical details on the vulnerability, identified as CVE-2026-65660. Patches have been made available for the issue.