SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

A SharePoint Server vulnerability, CVE-2026-65660, was initially classified by Microsoft as a spoofing flaw with a CVSS score of 6.5. However, Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details revealing the flaw actually enables authenticated remote code execution. The vulnerability affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft has released patches for the affected versions. The misclassification highlights the importance of thorough vulnerability analysis beyond vendor-assigned severity ratings. The authenticated RCE capability makes this significantly more dangerous than the original spoofing classification suggested.