Microsoft has confirmed a serious remote code execution (RCE) vulnerability in on-premises SharePoint Server—tracked as CVE-2026-65660—that allows an authenticated, low-privileged user to run arbitrary code across the network without any user interaction. The flaw impacts SharePoint Server 2016, 2019, and Subscription Edition, and comes with a CVSS score of 8.8. This poses a major risk given how SharePoint environments often handle sensitive data while operating under powerful service credentials.
How the Vulnerability Works
The discovery, made by researcher Dinh Ho Anh Khoa, reveals that the issue bypasses SharePoint’s SafeControls protection. SafeControls is meant to block untrusted server-side classes during the processing of page or Web Part markup. However, the flaw lies in the ToolPane component’s handling of Registerdirectives, which map tag prefixes to ASP.NET controls.
The attack vector begins when the ToolPane separates Register directives from control markup for validation. When the directive values are later reconstructed—wrapped in double-quoted attributes—the system fails to properly escape embedded quotation marks. This misordering allows malicious input to inject new directives after safety checks but before control parsing by ASP.NET. The exploit chain demonstrated uses XamlServices.Parse, ExpandedWrapper, ObjectDataProvider, and LosFormatter deserialization to achieve code execution.
Threats, Exposure, and Patch Status
Success in exploiting this flaw could give attackers a foothold to steal credentials, move laterally, exfiltrate data, or maintain persistent access. While any exploitation requires authenticated access under normal conditions, the researcher also showed that in configurations where anonymous access to certain pages is allowed, this vulnerability could be chained with a separate authentication weakness to allow RCE without authentication. Microsoft addressed that particular bypass in an update released June 9, 2026.
Security updates for this vulnerability were issued on August 11, 2026. Patched build versions are: 16.0.5565.1001 for SharePoint 2016; 16.0.10417.20198 for SharePoint 2019; and 16.0.19725.20522 for Subscription Edition. Microsoft’s advisory emphasizes that all relevant update packages must be applied, and that SharePoint 2016 installations might need more than one package.
The disclosure also notes the same technique could affect SharePoint 2013, which is out of support since April 2023. Although Microsoft has not listed 2013 among the officially supported affected products, those still using it are urged to either migrate to a supported version or isolate systems until they can be better secured.
Recommendations and What Administrators Should Do
Given that the public release includes working proof-of-concept exploit markup, defenders should assume the risk is elevated. Immediate actions include installing the patches, restricting anonymous and internet-facing access, reviewing permissions for low-privilege accounts, and hunting for Web Part markup or encoded XAML in odd POST requests.
Incident response should also look for telltale signs of in-memory webshell activity: unexpected child processes, unusual assemblies, volatile memory anomalies. Before restarting servers, preserve logs from IIS, ULS, Windows events, endpoint telemetry, and PowerShell. These actions help detect exploit activity that may leave little footprint on disk.
The public exploit details mean attackers could more easily reproduce the flaw. Systems that haven’t yet applied the update should consider the exposed scenario — especially if anonymous access is allowed — as high risk. Those still on SharePoint 2013 face particularly dangerous odds. Administrators should prioritize patching, configuration changes, and monitoring now.
