Microsoft SharePoint CVE-2026-65660 (CVSS 8.8, code injection) is exploited in the wild. …

🤖 Microsoft SharePoint CVE-2026-65660 (CVSS 8.8, code injection) is exploited in the wild. First rated a spoofing bug, Microsoft upgraded it to RCE after observing attacks; CISA added it to KEV. Patch now. …

Signals

as the pipeline stamped them

KEV: Active exploitation (KEV)
Exposure: Exposure: ~190,200 MikroTik exposed worldwide (05 Oct)
What to do: 1.On CISA KEV — actively exploited. Patch immediately.
2.~190,200 MikroTik are exposed worldwide — check your own version.

CISA KEV means this flaw has been seen exploited in real attacks — not predicted, observed. Treat it as urgent regardless of its score.

CVE

KEV from CISA · EPSS from FIRST

CVE ids in this dispatch with their KEV status and EPSS score
Id	KEV	EPSS	Reference
CVE-2026-65660	KEV	2%	NVD ↗

Get the next one first.

Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.