A SharePoint Server vulnerability that Microsoft originally labeled a moderate spoofing issue actually permits authenticated attackers to execute code remotely, according to technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, designated CVE-2026-65660, impacts SharePoint Server 2016, 2019, and Subscription Edition. Microsoft's advisory initially classified the issue as a spoofing vulnerability with a CVSS severity score of 6.5, but the National Vulnerability Database rates it 8.8, reflecting its true remote code execution potential.
Microsoft's official advisory describes CVE-2026-65660 as enabling an authorized attacker to carry out spoofing and assigns zero impact to integrity or availability. However, the CVE record that Microsoft published separately, updated on September 11, labels the same vulnerability a remote code execution flaw and states it allows an authorized attacker to execute code. Both records assign CWE-94, a code-injection weakness. Patches became available in the August 11 security updates. Security teams who prioritized CVE-2026-65660 based on the advisory encountered a moderate spoofing problem, not a code-execution threat with a near-maximum severity rating. Khoa also demonstrated the original ToolShell exploit chain against SharePoint at Pwn2Own Berlin in May 2025, which Chinese state-backed groups later exploited and prompted emergency patches from Microsoft. The researcher has since disclosed several other SharePoint vulnerabilities, including CVE-2026-55040, an authentication bypass that attackers exploited shortly after its details became public in August.
The CVE-2026-65660 vulnerability exists in how SharePoint verifies whether server-side controls appear on the SafeControls list, a filter that blocks dangerous classes from loading, according to the researcher. When the ToolPane component processes web-part markup, it reconstructs Register directives by placing attribute values between double quotes without escaping quotes inside them. An attacker can inject additional directives through the unescaped quotes, registering arbitrary .NET classes after the type check runs but before the control loads. With arbitrary class loading, the attacker uses XamlServices.Parse() to trigger code execution through deserialization. Khoa said the writeup includes a working in-memory webshell payload that avoids the registry permission failures other deserialization methods encounter. The researcher also demonstrated that the flaw can be chained with a separate, already-patched authentication bypass to reach pre-authentication remote code execution on servers configured to allow anonymous page access.
The authentication bypass was fixed in a June 9 patch, and servers that applied the fix aren't exposed to the pre-authentication path, Khoa says. No exploitation of CVE-2026-65660 has been reported in the wild, and the flaw doesn't appear in CISA's Known Exploited Vulnerabilities catalog. Microsoft's advisory rates exploitation as unlikely, though the full exploit markup is now public. Khoa says he has used the exploit in penetration testing engagements. The August 11 patch fixes the flaw and turns off the vulnerable function by default, according to the researcher. Khoa says the flaw also affects SharePoint 2013, though Microsoft's advisory lists only 2016, 2019, and Subscription Edition. SharePoint 2013 has been out of support since April 2023 and receives no security updates. Organizations running supported SharePoint versions should verify they've applied the August patches, particularly given the discrepancy between Microsoft's initial public assessment and the vulnerability's actual capabilities. The disconnect between the advisory's spoofing classification and the CVE record's code-execution warning suggests defenders may have deferred patching based on incomplete information.