CVE-2026-65660

An authenticated attacker can execute arbitrary code on Microsoft SharePoint via unsafe deserialization, and the flaw is actively exploited in the wild.

Microsoft SharePoint contains a critical code injection vulnerability allowing remote code execution over the network. The flaw requires only authenticated access at the Site Member level, a low permission threshold common in enterprise deployments, to achieve server-side code execution. DIB organizations must urgently patch this unpatched, actively exploited vulnerability to prevent ransomware or data breaches, as it is not a zero-day but a known, neglected CVE.

Shame score — A critical remote code execution flaw requiring only low-privilege authenticated access is actively exploited in the wild, indicating severe negligence in patching and vulnerability management.