SharePoint vulnerability CVE-2026-65660 is remote code execution

A SharePoint vulnerability tracked as CVE-2026-65660, which Microsoft first listed as a spoofing flaw with a severity score of 6.5, actually allows an authorized attacker to run their own code on the server. That is the conclusion of full technical details published by Dinh Ho Anh Khoa, a researcher at Viettel Cyber Security, and it matches what Microsoft's own CVE record says: updated on September 11, that record calls the same issue a remote code execution vulnerability and states that it lets an authorized attacker execute code. The National Vulnerability Database, a separate public catalogue of software flaws, scores it 8.8.

The two Microsoft descriptions sit side by side and point in different directions. Microsoft's advisory tells administrators that the flaw lets an authorized attacker perform spoofing and assigns no impact to integrity or availability, which means the company listed no risk of data being altered and no risk of a service going down. The CVE record that Microsoft publishes separately, updated on September 11, titles the identical flaw a remote code execution vulnerability. Both records assign the weakness classification CWE-94, which covers code injection, a category of bug where an attacker manages to slip their own instructions into a program. The practical consequence, as the researcher's writeup sets out, is that defenders who triaged CVE-2026-65660 using the advisory alone saw a moderate spoofing bug rather than a code execution hole carrying a score close to the top of the scale.

According to the technical details Khoa published, the problem lies in the way SharePoint checks whether server-side controls are on the SafeControls list. That list is a filter intended to stop dangerous program classes from being loaded on a SharePoint server. When the ToolPane component processes web-part markup, it rebuilds Register directives by writing attribute values between double quotation marks without escaping any quotation marks contained inside those values. An attacker can abuse those unescaped quotes to inject extra directives, registering arbitrary .NET classes after the type check has already run but before the control is actually loaded. .NET is the software framework SharePoint Server is built on. Once arbitrary class loading is possible, the attacker uses XamlServices.Parse() to trigger code execution through deserialization, the process of rebuilding stored data into live objects, which can run code if the data comes from an untrusted source. Khoa said the writeup includes a working in-memory webshell payload, a small piece of code that gives an attacker a persistent command interface on the server, and that this payload avoids the registry permission failures that other deserialization methods run into.

The researcher also demonstrated that the flaw can be chained with a separate authentication bypass that has already been patched, in order to reach pre-authentication remote code execution on servers configured to allow anonymous page access. Pre-authentication means an attacker does not need any valid account to attack; anonymous page access means the server lets visitors view pages without logging in. Khoa says that bypass was fixed in a June 9 patch, and that servers which applied the fix are not exposed to the pre-authentication path.

CVE-2026-65660 is not the first SharePoint issue Khoa has worked on. He is the researcher who demonstrated the original ToolShell exploit chain against SharePoint at Pwn2Own Berlin in May 2025, a chain that was later exploited by Chinese state-backed groups and that triggered emergency patches from Microsoft. He has since disclosed several other SharePoint flaws, among them CVE-2026-55040, an authentication bypass that attackers exploited shortly after its details became public in August. Khoa says he has used the CVE-2026-65660 exploit in penetration testing engagements, which are authorized tests where a client asks a specialist to attack their own systems.

On the defensive side, patches have been available since the August 11 security updates, and the vulnerability affects SharePoint Server 2016, 2019 and Subscription Edition. According to the researcher, the August 11 patch fixes the flaw and turns off the vulnerable function by default. Khoa says the flaw also affects SharePoint 2013, although Microsoft's advisory lists only the other three versions. SharePoint 2013 has been out of support since April 2023 and receives no security updates, which leaves it without a vendor fix. No exploitation of CVE-2026-65660 has been reported in the wild, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, a public list of bugs that attackers are confirmed to be using. Microsoft's advisory rates exploitation as unlikely, though the full exploit markup is now public, and the researcher's writeup was published in full today. That combination, a public exploit and a severity dispute between two records from the same vendor, is the part worth acting on rather than debating.

For the organizations that run SharePoint, the takeaway is straightforward: confirm which version you run, confirm the August 11 updates are installed, and check with whoever administers the platform whether the vulnerable function is now disabled by default, since Microsoft's advisory and its CVE record did not describe the same risk. If your team would rather not track patch cycles and advisory discrepancies alone, AEU-I provides security-first IT and infrastructure consulting for businesses that want an outside pair of eyes on exactly this kind of maintenance work, and its scope is described at https://aeu-i.com.