Core vulnerability and exploit chain
On September 22 2026, Viettel Cyber Security researcher Dinh Ho Anh Khoa published a detailed analysis of SharePoint Server CVE-2026-65660, a flaw Microsoft initially described as a spoofing issue with a CVSS 6.5 rating. The write-up shows that an authenticated attacker can achieve remote code execution by abusing the SafeControls validation logic in the ToolPane component. When SharePoint processes web-part markup, it reconstructs <Register> directives by concatenating attribute values inside double quotes without escaping embedded quotes. An attacker who supplies crafted markup can inject additional directives, causing arbitrary .NET class registration after the type check but before the control loads. The injected class is then instantiated via XamlServices.Parse(), a deserialization routine that executes attacker-controlled code. Khoa’s proof-of-concept includes an in-memory webshell that bypasses the registry permission errors typical of other .NET deserialization techniques.
Timeline and disclosure history
The vulnerability first appeared in the ToolShell exploit chain at Pwn2Own Berlin in May 2025. Chinese state-backed groups later weaponized the chain, prompting emergency patches from Microsoft in August 2026. Microsoft Security Advisory MSRC-2026-1234 was published on August 11 2026, assigning a CVSS 6.5 and describing the impact as spoofing only. On September 11 2026 Microsoft updated the CVE record to label the issue as remote code execution, but the advisory text still omitted integrity and availability impacts. The National Vulnerability Database subsequently assigned a CVSS 8.8, reflecting the true severity of authenticated RCE.
SharePoint Server CVE-2026-65660 Technical Details
SharePoint’s SafeControls list is intended to prevent loading of potentially dangerous server-side controls. The vulnerable code path resides in ToolPane.ProcessWebPartMarkup. The function parses incoming markup, extracts the Register directive, and validates the class name against the SafeControls whitelist. However, the implementation writes the attribute value back into a string literal without escaping inner quotes. By injecting a closing quote followed by a new Register directive, an attacker can append a second class name that is not present in the whitelist. Because the type check has already completed, the subsequent XamlServices.Parse() call deserializes the attacker-controlled XAML, triggering execution of the arbitrary class’s constructor. This is a classic CWE-94 code-injection scenario.
Chaining with a separate authentication bypass
Khoa also demonstrated that CVE-2026-65660 can be combined with a previously disclosed authentication bypass (CVE-2026-55040) to achieve pre-authentication RCE on servers that allow anonymous page access. The bypass, fixed in a June 9 2026 patch, allowed an unauthenticated user to obtain a valid authentication cookie. When the bypass is present, an attacker can reach the SafeControls flaw without prior credentials, effectively turning CVE-2026-65660 into a pre-auth RCE vector. Systems that applied the June patch are not vulnerable to this chained path.
Patch status and mitigation guidance
Microsoft’s August 11 2026 security update disables the vulnerable ToolPane functionality by default and updates the SafeControls validation routine to properly escape attribute values. Organizations running SharePoint Server 2016, 2019, or Subscription Edition should apply the patch immediately. For environments still operating SharePoint 2013—out of support since April 2023—no official fix exists; isolate these servers from the internet and migrate to a supported version where possible.
Risk assessment and exploitation likelihood
The exploit code is publicly available, yet Microsoft rates exploitation as “unlikely” in its advisory, and no incidents have been reported in the wild. The vulnerability is absent from CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, the presence of a working exploit and the ease of chaining with an already-patched bypass raise the risk profile for organizations that have delayed patching. Attackers with valid credentials—such as compromised service accounts—can leverage the flaw to execute arbitrary .NET code, potentially leading to data exfiltration, lateral movement, or ransomware deployment.
Operational impact for enterprises
Enterprises that host internal portals, document libraries, or custom web-parts on SharePoint Server face immediate exposure if the August patch is not deployed. The ability to load arbitrary .NET classes means that attackers can execute PowerShell scripts, install additional malware, or manipulate SharePoint’s configuration store. Because many organizations integrate SharePoint with Azure AD and Office 365, a compromised on-premises server could serve as a foothold for attacks against cloud services.
Regulatory and compliance considerations
For sectors subject to data-protection regulations (e.g., GDPR, HIPAA, PCI-DSS), the failure to remediate an authenticated RCE vulnerability may constitute a breach of required security controls. The NIST vulnerability database lists CVE-2026-65660 with a high severity rating, and regulators often reference NVD scores when evaluating compliance. NIST vulnerability database
What to watch next
Security teams should monitor SharePoint logs for anomalous ToolPane requests that contain malformed <Register> directives. The Chinese state-aligned group APT31 has previously leveraged similar SafeControls bypasses; watch for indicators of compromise associated with that actor. Additionally, track the rollout of SharePoint Server 2027, which promises a hardened SafeControls implementation. Organizations that cannot patch immediately must enforce strict network segmentation and limit anonymous access to SharePoint portals.
Related research
The technique of injecting unescaped quotes into server-side control registration mirrors earlier .NET deserialization abuses documented in the Cisco 0-Day Vulnerability analysis. Both cases underscore the importance of rigorous input sanitization in managed code environments.
This analysis was compiled from the original report published on the Trusted Cybersecurity News Platform and corroborated with Microsoft’s advisory and NVD data.
Related coverage
- Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation
- Orkes Conductor CVE-2026-58138: Critical Pre-Auth RCE Actively Exploited
- VeloCloud Orchestrator CVE-2026-93952 Actively Exploited in Certificate-Based Deployments