Microsoft: CVE-2026-65660 Added to CISA KEV Under Active Exploitation
CISA has added a critical Microsoft vulnerability, CVE-2026-65660, to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation in the wild.
Key findings
- CVE-2026-65660, a Microsoft vulnerability, is confirmed under active exploitation.
- CISA added this flaw to its KEV catalog on September 25, 2026.
- Immediate patching of affected Microsoft products is critical for all organizations.
- No current association with ransomware campaigns has been reported for this CVE.
CISA has issued an alert regarding a newly identified vulnerability, CVE-2026-65660, affecting Microsoft products. This flaw has been added to the agency's authoritative Known Exploited Vulnerabilities (KEV) Catalog on September 25, 2026, signaling that it is under active exploitation by threat actors. The inclusion in the KEV catalog underscores the immediate risk this vulnerability poses to federal civilian executive branch (FCEB) agencies and, by extension, all organizations.
CVE-2026-65660, while specific details of its impact are not fully disclosed in this alert, represents a significant security concern due to its confirmed active use in attacks. Organizations running affected Microsoft software are at heightened risk of compromise if the vulnerability remains unpatched. The nature of active exploitation means that adversaries are already leveraging this flaw to gain unauthorized access, execute malicious code, or achieve other nefarious objectives.
There is no indication at this time that CVE-2026-65660 is associated with ransomware campaigns. However, any actively exploited vulnerability can serve as an initial access vector for a wide range of post-exploitation activities, including data exfiltration, lateral movement, and ultimately, ransomware deployment.
Defenders must prioritize the immediate remediation of CVE-2026-65660. CISA's KEV catalog mandates that FCEB agencies address these vulnerabilities by specific due dates, typically within a matter of weeks. All other organizations are strongly advised to follow this guidance, identifying and patching all instances of the affected Microsoft software without delay. Implementing robust patch management processes and continuous monitoring for signs of compromise are crucial steps to mitigate the risks associated with this and other actively exploited flaws.