CVE-2026-65660

What is Microsoft SharePoint Server?

SharePoint Server is Microsoft's on-premises collaboration and document management platform. Organizations run it as an intranet portal, a document library, and an application host for workflows and custom web parts. It sits at the center of a company's internal file sharing, so it holds sensitive documents by design, and it typically runs under a service account with broad reach into Active Directory and SQL Server. A SharePoint farm compromise therefore tends to become a domain compromise. On-premises SharePoint has been one of the most heavily attacked enterprise products of the past two years, most notably through the ToolShell chain, which makes every new code execution path in the product an immediate target.

Overview

CVE-2026-65660 is a code injection vulnerability (CWE-94) in on-premises SharePoint Server that lets an authenticated, low-privileged user bypass the SafeControls allowlist and execute arbitrary code on the server. SafeControls is the mechanism that decides which .NET types a SharePoint page is permitted to instantiate, so a bypass of it converts ordinary content-author access into full code execution in the context of the SharePoint application pool.

The CVE has an unusual paper trail. Microsoft shipped the fix in the August 11, 2026 security updates and described the issue in its Security Update Guide as a SharePoint Server spoofing vulnerability. On September 11, 2026 Microsoft updated the published CVE record to retitle the same flaw as remote code execution, and the NVD entry carries a CVSS 3.1 base score of 8.8 with a code injection weakness. Defenders who triaged the August release on the spoofing label alone are likely to have underrated it.

Technical details and a working technique became public on September 22, 2026, and CISA added the CVE to the Known Exploited Vulnerabilities catalog three days later, on September 25, 2026, citing evidence of exploitation in the wild. The remediation deadline for federal agencies is September 28, 2026.

Affected Versions

SharePoint Online in Microsoft 365 is not affected. The researcher reports that SharePoint 2013 is vulnerable to the same technique even though Microsoft's advisory does not list it, because that release passed end of support in April 2023.

Technical Details

The flaw is in how the ToolPane component handles web part markup. When SharePoint rebuilds the Register directives declared in that markup, it writes each attribute value between double quotes without escaping any double quotes already inside the value. That is a classic unsafe string concatenation: the researcher's summary of the code is that it appends the attribute value to a format string with no check at all.

An attacker who can submit web part markup closes the quoted attribute early and splices in an entirely new Register directive. The critical detail is ordering. The SafeControls type check has already run by the time the spliced directive is processed, so the injected directive registers an arbitrary .NET class that was never validated. With arbitrary type registration in hand, the exploit reaches XamlServices.Parse() and deserializes an ObjectDataProvider gadget, which yields code execution. The published payload runs an in-memory web shell rather than writing a file to disk, which both defeats file-integrity monitoring and avoids the registry permission errors that other SharePoint deserialization gadgets hit.

Attack characteristics: network reachable, low complexity, no user interaction, and low privileges required (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The privilege requirement is the only real barrier, and it is a low one, since any account able to edit a page or add a web part qualifies. It can be removed entirely by chaining: the researcher demonstrated pairing this bug with CVE-2026-55040, a SharePoint authentication bypass patched on June 9, 2026, and by targeting endpoints such as AddGallery.aspx on farms that permit anonymous page access. Either route makes the result an unauthenticated remote code execution.

Discovery

The vulnerability was found and reported by Dinh Ho Anh Khoa (khoadha) of Viettel Cyber Security, working out of VCSLab. Khoa is the researcher who demonstrated the original ToolShell SharePoint chain at Pwn2Own Berlin in May 2025 and who disclosed the CVE-2026-55040 authentication bypass earlier in 2026. VCSLab published the full technical analysis, including the exploitation primitive and the in-memory web shell payload, on September 22, 2026.

Exploitation Context

At the time of the September 22 disclosure, no in-the-wild exploitation had been reported and Microsoft's own exploitability assessment was "exploitation less likely." That position did not hold. CISA added the CVE to KEV on September 25, 2026 on the basis of confirmed active exploitation, and threat intelligence firm Previdian reported observing live attempts that chain CVE-2026-65660 with a separate anonymous-access delivery bug to drop an encrypted .NET loader and establish control of the server. No named threat actor has been attributed publicly, and no ransomware use has been recorded in the KEV entry.

No precise exposure count for vulnerable builds has been published. The relevant population is large: on-premises SharePoint farms number in the hundreds of thousands worldwide, and internet-facing extranet deployments are common. Given the public write-up, the short interval between disclosure and KEV listing, and this product's history after ToolShell, commodity exploitation should be expected rather than anticipated.

Remediation

1. Install the August 2026 security update or later for your edition: Subscription Edition 16.0.19725.20522, SharePoint 2019 16.0.10417.20198, or SharePoint 2016 16.0.5565.1001. The fix disables the vulnerable code path by default. Federal agencies are required to complete this by September 28, 2026.
2. Migrate or isolate SharePoint 2013. It is vulnerable and will not receive a patch. Take it off the internet and plan an upgrade.
3. Remove anonymous access from internet-facing farms. Anonymous page access is what converts this from an authenticated bug into a pre-auth one. Audit which web applications and site collections allow it, particularly the _layouts gallery pages.
4. Confirm CVE-2026-55040 is patched. A farm missing the June 9, 2026 authentication bypass fix is exposed to the full unauthenticated chain regardless of account hygiene.
5. Hunt for prior compromise. An in-memory web shell leaves little on disk, so look at IIS logs for unusual POST requests to ToolPane and gallery endpoints, at the SharePoint ULS logs for control registration or XAML parsing errors, and at outbound connections from the SharePoint servers and the identity of the application pool account. Check for new or modified .aspx files, unexpected farm solutions, and additions to the SafeControls entries in web.config.
6. Rotate credentials if compromise is suspected. Code execution here runs as the application pool identity; treat that account, the farm account, and any secrets stored in the farm as exposed, and review Active Directory for follow-on activity.