SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

Severity

High

Detail

Security researcher Dinh Ho Anh Khoa of Viettel Cyber Security has disclosed technical details for CVE-2026-65660, a Microsoft SharePoint Server vulnerability that was initially described by Microsoft as a spoofing issue but has since been shown to enable authenticated remote code execution (RCE).

According to the published research, the flaw exists within SharePoint’s SafeControls validation mechanism, which is designed to restrict the loading of potentially dangerous server-side controls. Successful exploitation allows an authenticated attacker to bypass these restrictions, load arbitrary .NET classes, and execute malicious code on the SharePoint server.

The disclosure is particularly significant because the researcher previously demonstrated the ToolShell exploit chain at Pwn2Own Berlin 2025, which was later exploited in real-world attacks by China-linked threat actors.

How?

The vulnerability resides in the way SharePoint processes Register directives within web-part markup through the ToolPane component. During processing, SharePoint reconstructs Register directives by inserting attribute values between quotation marks without properly escaping attacker-controlled quote characters.

An authenticated attacker can exploit this weakness by injecting additional Register directives through crafted input. Because these directives are processed after SharePoint performs its SafeControls validation checks, attackers can register and load arbitrary .NET classes that would normally be blocked.

Once arbitrary class loading is achieved, the attacker can leverage XamlServices.Parse() to trigger code execution through a deserialization process. The researcher demonstrated a working in-memory web shell payload capable of executing commands directly on the SharePoint server.

The research further showed that CVE-2026-65660 could previously be chained with a separate SharePoint authentication bypass vulnerability to achieve pre-authentication RCE. However, Microsoft addressed the authentication bypass issue in June 2026, and systems that applied the relevant security updates are not exposed to this attack path.

Microsoft released security updates for CVE-2026-65660 on August 11, 2026, and according to the researcher, the patch both fixes the vulnerability and disables the affected functionality by default.

Affected Products

• Microsoft SharePoint Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

The researcher reported that SharePoint 2013 is also affected. However, SharePoint 2013 reached end of support in April 2023 and no longer receives security updates from Microsoft.

Conclusion

CVE-2026-65660 is a high-risk SharePoint vulnerability that may allow authenticated attackers to execute arbitrary code by bypassing SharePoint’s SafeControls protection mechanism. The publication of full technical details increases the likelihood of exploitation attempts, particularly against internet-facing or unpatched SharePoint environments.

Organizations using affected SharePoint versions should ensure that Microsoft’s August 2026 security updates have been applied immediately. Security teams should also monitor for suspicious SharePoint activity, investigate unusual deserialization events, review authentication logs, and identify potential web shell behavior. Special attention should be given to unsupported SharePoint 2013 deployments, which may remain vulnerable without an available vendor patch.

Source

https://nvd.nist.gov/vuln/detail/cve-2026-65660

https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html