SharePoint Code-Injection Flaw Opens a Low-Privilege Route to Remote Server Control

A Microsoft SharePoint Server vulnerability originally presented as a spoofing issue is now classified as remote code execution, with public research demonstrating a working exploitation path.

CVE-2026-65660 allows an authenticated attacker with low-level privileges to execute arbitrary code remotely. No user interaction is required, and successful exploitation can compromise the confidentiality, integrity, and availability of the SharePoint server.

Microsoft now rates the vulnerability Important, with a CVSS base score of 8.8. The National Vulnerability Database assigns the same score and classifies the defect as CWE-94, or improper control of code generation.

As of September 22, 2026, no exploitation in the wild has been reported. However, researcher Dinh Ho Anh Khoa of Viettel Cyber Security has released technical details and demonstrated an in-memory webshell, materially reducing the barrier to reproducing the attack.

Microsoft revised the flaw’s impact after its initial publication

Microsoft released the security update for CVE-2026-65660 on August 11, 2026. The company’s advisory was last updated on August 27, 2026, when its revision history recorded changes to the vulnerability title, impact description, and frequently asked questions.

The issue was reportedly first characterized as spoofing, with a CVSS score of 6.5 and no effect on confidentiality, integrity, or availability. The current Microsoft MSRC entry instead describes remote code execution and uses this vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Microsoft lists base and temporal scores of 8.8 and 7.7, respectively. Its assessment indicates network-based exploitation, low complexity, low privileges, no user interaction, and high impact across all three primary security properties.

The vendor still labels exploitation as “Less Likely” and records the issue as neither publicly disclosed nor exploited in its assessment table. That status sits uneasily beside the recently published researcher analysis, which includes functional exploit material.

These statements measure different things. Microsoft’s table reflects its formal tracking and exploitability assessment, while the public research establishes that a practical technique and working demonstration are available. Public proof of concept does not establish active exploitation, but it gives defenders less time to treat the flaw as merely theoretical.

Unsafe markup reconstruction defeats SharePoint’s SafeControls boundary

The vulnerability resides in SharePoint’s processing of server-side controls. SharePoint uses a SafeControls list to restrict which classes can be loaded, preventing untrusted or dangerous controls from being instantiated on a server.

The vulnerable path passes through the ToolPane component while it processes web-part markup. When ToolPane reconstructs Register directives, it places attribute values between double quotes without correctly escaping quote characters already present inside those values.

An attacker can exploit that parsing error to insert additional directives into the reconstructed markup.

The sequencing is crucial. The malicious directives allow arbitrary .NET classes to be registered after SharePoint has performed its SafeControls type check, but before the control is loaded. The server therefore validates one state and subsequently processes attacker-altered markup, bypassing the restriction that should govern control loading.

Khoa’s demonstration then uses XamlServices.Parse() to obtain code execution through deserialization. The published technique employs an in-memory webshell designed to avoid registry-permission errors encountered with other deserialization approaches.

The attack does not require an administrator account. According to Microsoft’s description, a user with low-level authenticated access can send a specially constructed request that causes the SharePoint server to execute attacker-controlled code. No separate victim must open a document, visit a page, or approve an action.

The NVD vector captures that exposure:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In practical terms, successful exploitation may let an attacker read sensitive server data, alter SharePoint content or configuration, and disrupt service availability.

Three supported product lines are named, while SharePoint 2013 remains uncertain

Microsoft identifies the following affected products:

• SharePoint Server 2016
• SharePoint Server 2019
• SharePoint Server Subscription Edition

NVD defines the vulnerable range as Microsoft SharePoint Server versions earlier than 16.0.19725.20522.

Microsoft also says customers using SharePoint Server 2016 and SharePoint Enterprise Server 2016 should install the same KB-numbered security update. If the deployed software is offered multiple applicable updates, administrators should install all of them; their installation order does not matter.

Khoa additionally identifies SharePoint 2013 as affected, although that product is not included in Microsoft’s list for this advisory. SharePoint 2013 has been unsupported since April 2023 and no longer receives security updates.

Organizations still running SharePoint 2013 consequently face a different remediation problem. Where no vendor fix exists, they should isolate, replace, or discontinue those systems rather than assume that the supported-product patch can be applied.

A separate authentication bypass can remove the login requirement

CVE-2026-65660 normally requires low-level authenticated access. Under specific conditions, however, it can be combined with CVE-2026-55040, a separate SharePoint authentication bypass, to achieve pre-authentication remote code execution.

The chain applies to servers configured to permit anonymous page access and still vulnerable to the authentication bypass. It does not make every unpatched CVE-2026-65660 deployment remotely exploitable without credentials.

CVE-2026-55040 affects SharePoint Server versions below 16.0.19725.20434 and was fixed in a June 9 patch. Systems that installed that fix are not exposed to the described pre-authentication route.

NVD rates the bypass 9.1, with the vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18, 2026, setting an August 21, 2026 remediation deadline for US federal agencies. Its required action calls for vendor mitigations, compliance with BOD 26-04 and associated forensic-triage requirements, applicable cloud guidance, or discontinuation when mitigations are unavailable.

CVE-2026-65660 itself is not in the KEV catalog. There is consequently no CISA deadline for that flaw, and no reported evidence currently establishes active exploitation.

The distinction remains operationally important: CVE-2026-55040 is confirmed as exploited, while CVE-2026-65660 has public exploit research but no reported in-the-wild activity.

Public research raises the urgency despite the absence of KEV status

Khoa previously demonstrated the original SharePoint ToolShell chain at Pwn2Own Berlin in May 2025. Chinese state-backed groups subsequently used that chain, prompting emergency patches from Microsoft.

Attackers also exploited CVE-2026-55040 shortly after technical information became public in August. That sequence does not prove that CVE-2026-65660 will follow the same path, but it provides relevant operational context for defenders assessing public SharePoint exploit material.

Microsoft has also had several other vulnerabilities enter CISA’s KEV catalog within the last 90 days: CVE-2026-85880 and CVE-2026-81963 on September 8, 2026; CVE-2019-1068 on August 26, 2026; CVE-2026-33824 on August 18, 2026; CVE-2026-68820 on August 11, 2026; and CVE-2026-50522 on July 22, 2026.

That broader record supports prioritizing exposed Microsoft server products according to exploitability and internet reach, rather than waiting for each vulnerability to receive KEV status.

Administrators should patch both vulnerabilities and hunt for abnormal control loading

Organizations running supported SharePoint editions should install Microsoft’s August 11, 2026 security updates and verify that their build is not below 16.0.19725.20522. The researcher reports that the update fixes CVE-2026-65660 and disables the vulnerable function by default.

Administrators should also confirm that the separate CVE-2026-55040 fix is present, particularly on servers allowing anonymous page access. For that issue, builds below 16.0.19725.20434 fall within the affected range.

Defensive reviews should focus on:

• Suspicious authenticated requests to SharePoint endpoints
• Unexpected ToolPane or web-part processing
• Abnormal or injected Register directives
• Unusual server-side .NET class loading
• Invocation of XamlServices.Parse() in suspicious execution paths
• In-memory webshell behavior
• Anonymous access enabled on servers missing the authentication-bypass fix

No specific file hashes, network indicators, or other forensic artifacts have been disclosed. Hunting must therefore concentrate on the exploitation behaviors and on unusual activity from low-privilege SharePoint accounts.

Unsupported SharePoint 2013 deployments deserve separate attention. If organizations cannot apply a supported vendor fix, isolation or replacement is the safer course.