Why a Severity Downgrade in a Vendor Advisory Can Leave You Exposed

VulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. triage runs on the numbers the vendor hands you. A CVSS score, a severity word, an "exploitation less likely" note: these drive whether a patch goes in tonight or waits for the next maintenance window. That works until the numbers change. CVE-2026-65660 in SharePoint began life as a spoofing bug scored 6.5, then became a remote code execution flaw scored 8.8 through a revision Microsoft labeled "informational." Organizations that triaged it once, on the first rating, and never looked again were exposed by the time it was exploited. This article is about building a program that survives a vendor changing its mind.

Why Severity Ratings Move

A severity rating is a snapshot of what the vendor understood at publication. New information routinely invalidates it. A researcher publishes a working exploit chainExploit Chain🛡️Two or more vulnerabilities used in sequence so that each one supplies the access the next one requires, for example an unauthenticated SSRF that reaches a command injection which alone would need administrator credentials. Chains let attackers turn moderate individual flaws into unauthenticated remote code execution. that proves a "spoofing" bug is really code execution. A proof of concept drops, moving a vulnerability from theoretical to practical. A flaw that requires authentication turns out to combine with a second bug for pre-authentication access. Exploitation is observed in the wild, which is what moved CVE-2026-65660 onto the CISA Known Exploited Vulnerabilities catalog. None of these change the underlying code, but all of them change the risk, and a program that only reads the score at first publication never sees the update.

CISA's own scoring approach acknowledges this. Its Stakeholder-Specific Vulnerability Categorization model asks not just how bad a bug is in the abstract but whether it is being actively exploitedActively Exploited🛡️A vulnerability that attackers are currently using in real-world attacks, requiring immediate patching regardless of severity score. and how automatable the attack is, factors that shift over time. A static CVSS base score cannot capture a change in exploitation status; a decision process that re-reads exploitation signals can.

The Failure Mode: Triage as a One-Time Event

The common weakness is treating triage as something you do once per CVE. A ticket is opened, a severity is recorded, a remediation date is set from that severity, and the ticket proceeds on rails. If the vendor revises the advisory two weeks later, nothing in the process notices, because nothing is watching the advisory after the initial read.

This is how a six-week gap opens. CVE-2026-65660 was patched on 11 August, reclassified upward on 27 August, and exploited by late September. An organization that pulled the 6.5 spoofing rating in August and scheduled it accordingly had every opportunity to catch the 8.8 revision, and no mechanism to do so. The reasoning parallels why one hotfixHotfix🛡️An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required. is rarely enough: planning for incomplete patches. In both cases the mistake is assuming the vendor's first word is the last one.

Building Re-Triage Into the Program

Re-triage is a deliberate step, not a hope that someone notices a news story. A few practices make it reliable.

• **Subscribe to advisory revisions, not just new advisories.** Vendor security feeds and the National Vulnerability Database record modification dates. Monitor for changes to CVEs already in your backlog, and treat a modification as a trigger to reassess, not as noise.
• **Wire the KEV catalog into your pipeline.** When a CVE you have deferred lands on CISA's exploited list, that should automatically escalate it. The KEV catalog is a machine-readable feed for exactly this purpose.
• **Re-score on new evidence.** A published exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access., an observed attack, or an upward vendor revision should reopen the ticket and recompute the remediation deadline from the new severity, overriding the original.
• **Track what you deferred and why.** A vulnerability you consciously postponed should carry the assumptions behind that decision, so that when an assumption breaks, such as "requires authentication" giving way to a pre-authentication chain, you can find every ticket that rested on it.

Do Not Trust the Label Over the Mechanism

The deeper lesson of CVE-2026-65660 is that a severity word can understate a mechanism. "Spoofing" sounds like a display or impersonation problem; the actual bug was an allowlist bypass leading to deserializationDeserialization🛡️The process of converting stored or transmitted data back into an object. Insecure deserialization can allow attackers to execute code by manipulating serialized data. and code execution, the mechanism explained in how .NET deserialization turns attacker data into code execution. When the technical description of a flaw and its assigned severity seem to disagree, believe the mechanism. A bug that lets an attacker choose which code a server loads is code execution regardless of the word on the advisory, and a triager who reads the CWE and the description rather than only the score will catch that before an attacker does.

Prioritize Ruthlessly, But Keep the Door Open

None of this means patching everything the instant a score ticks up. Most organizations cannot, and the discipline of prioritizing under load is real; we cover it in how to prioritize a record-size Patch TuesdayPatch Tuesday🛡️The second Tuesday of each month, when Microsoft releases its scheduled batch of security updates. The predictable cadence lets defenders plan deployment, but AI-assisted vulnerability discovery has pushed recent releases past 900 CVEs, straining triage. without patching everything first. Re-triage does not add work to every CVE. It adds a small number of high-value triggers, a vendor revision, a KEV addition, a public exploit, that pull specific vulnerabilities back onto the urgent list when the facts change. The cost is monitoring a few feeds and honoring the triggers when they fire. The alternative is what happened with this SharePoint flaw: a correct decision in August that had quietly become the wrong one by September, with no one in a position to notice.

The Takeaway

A vendor severity rating is an input to your risk decision, not the decision itself, and it has an expiration date you cannot see. Build a program that re-reads advisories after the first pass, escalates automatically when a deferred bug is exploited, and trusts the described mechanism when it conflicts with the assigned label. CVE-2026-65660 rewarded exactly that behavior and punished its absence.