Microsoft has upgraded its assessment of a SharePoint Server vulnerability, CVE-2026-65660, after full technical disclosure revealed it enables authenticated remote code execution (RCE)—far beyond the spoofing weakness it was initially described as. The flaw impacts SharePoint Server 2016, 2019, and Subscription Edition, and patches have been available since Microsoft’s August 11 security update.
The Discovery and Misclassification
Initially, Microsoft’s advisory classified CVE-2026-65660 as a spoofing issue—giving it a middle‐severity rating of 6.5—with no substantial risk to system integrity or availability. However, the official CVE record updated the description on September 11 to identify it as enabling RCE for authenticated attackers, raising its criticality. The National Vulnerability Database reflects this with a revised score of 8.8. Both Microsoft’s advisory and the CVE list the same underlying code‐injection vulnerability (classified under CWE-94). What appeared at first as purely a spoofing threat is now understood to offer far more dangerous attack paths.
Technical Mechanism & Exploit Details
The vulnerability lies in how SharePoint validates server-side controls, specifically whether they are in the SafeControls list—a filter meant to block untrusted classes. The ToolPane component, when processing certain web part markup, reconstructs Register directives but fails to escape double quotes inside attribute values. This lapse allows attackers to inject extra directives once the type check has passed but before the control is loaded.
Once arbitrary .NET classes are registered in this way, an attacker can use XamlServices.Parse() to invoke code execution via deserialization. The researcher published a working in-memory webshell payload that bypasses registry permission issues that plague other deserialization attacks. Further, in servers still running legacy or misconfigured authentication routines, this flaw can be chained with an already addressed authentication bypass for pre-authentication RCE—though Microsoft patched that bypass back on June 9 for affected systems.
Scope, Status, and Best Practices
No active exploitation of CVE-2026-65660 has been reported in production environments, and it is not included in the Known Exploited Vulnerabilities catalog maintained by CISA. Microsoft assesses that exploitation is unlikely, yet the exploit details are now public and have been used in pen testing and lab settings. Systems that applied the August 11 update are considered protected; the patch both fixes the vulnerability and disables the affected function by default.
SharePoint 2013 is also vulnerable according to the researcher, though it’s no longer supported since April 2023 and receives no security updates. Enterprises still running 2013 instances remain exposed without Microsoft’s mitigations.
This vulnerability is one of several SharePoint flaws recently disclosed by the same researcher, including CVE-2026-55040—an authentication bypass exploited shortly after public disclosure in August.
While Microsoft’s initial classification made this seem like a mid-level spoofing issue, it actually allows for elevated risks including authenticated remote code execution. For organizations using SharePoint Server 2016, 2019, or Subscription Edition, applying the August 11 patch is essential. If systems still run SharePoint 2013, urgent mitigation planning is needed.
What this means: Despite Microsoft’s initial guidance, CVE-2026-65660 demands urgent attention due to its potential for authenticated RCE—making it a far greater threat than initially portrayed. Watch for follow-on research revealing real-world exploitation, and ensure all supported SharePoint instances are patched; unsupported ones need migration or compensating controls to avoid exposure.
