Vulnerability
A Microsoft SharePoint flaw letting attackers bypass authentication to read or modify data without credentials; patched in July 2026.
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
Dinh Ho Anh Khoa's writeup turns CVE-2026-65660 into authenticated remote code execution on SharePoint 2016, 2019 and Subscription Edition. Microsoft's advisory scores the flaw 6.5 and calls it spoofing. NVD scores it 8.8.
Reality
Only one of the 398 CVEs Microsoft fixed in August was confirmed exploited, and the SharePoint chain now hitting servers turns on a July patch, which puts exposure on cycle lag rather than on ranking.
Reality
Attackers are forging tokens SharePoint accepts, then enumerating management APIs and probing Business Connectivity Services for the execution sink. BleepingComputer reports nobody has seen that last step land.
Reality
CVE-2026-55040 was patched in July. Rapid7 published the technical details and a script on August 11, and Defused says its honeypots logged exploitation on August 12.
Reality