CVE-2026-65660 was initially listed by Microsoft as a spoofing flaw with a CVSS score of 6.5 — but full technical details published by Viettel Cyber Security researcher Dinh Ho Anh Khoa show it enables authenticated remote code execution against SharePoint Server.
Microsoft's advisory versus the public CVE record
Microsoft's advisory described CVE-2026-65660 as allowing an authorized attacker to perform spoofing and assigned no impact to integrity or availability. That advisory carried a 6.5 CVSS severity. Separately, the CVE record that Microsoft publishes was updated on September 11 and titles the same flaw a remote code execution vulnerability, stating it allows an authorized attacker to execute code. The National Vulnerability Database assigns the vulnerability an 8.8 score and the record lists CWE-94, a code-injection weakness.
The different characterizations meant many defenders who triaged the issue from the advisory treated it as a moderate spoofing problem rather than a near-maximum code-execution risk.
Technical chain: SafeControls, ToolPane and XamlServices.Parse
Khoa’s writeup locates the flaw in SharePoint's check of whether server-side controls are listed in SafeControls, a filter intended to prevent dangerous classes from loading. When the ToolPane component processes web-part markup it reconstructs Register directives by writing attribute values between double quotes without escaping any quotes embedded inside them. That omission allows an attacker to inject additional directives by closing a quoted attribute and adding new Register entries.
Those injected Register directives can register arbitrary .NET classes after the type check runs but before the control loads. With arbitrary class loading available, the attacker invokes XamlServices.Parse() to trigger code execution through deserialization. Khoa published a working in-memory webshell payload that, he says, avoids the registry permission failures that other deserialization methods encounter.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogPatch history, affected versions, and related fixes
Patches addressing the flaw have been available since the August 11 security updates; Khoa says the August 11 patch fixes the flaw and turns off the vulnerable function by default. The Microsoft advisory lists SharePoint Server 2016, 2019, and Subscription Edition as affected.
Khoa additionally reported that the flaw also affects SharePoint 2013, but Microsoft’s advisory does not list 2013; the researcher noted SharePoint 2013 has been out of support since April 2023 and receives no security updates.
Khoa demonstrated that the flaw can be chained with a separate authentication bypass — already patched on June 9 — to achieve pre-authentication remote code execution on servers configured to allow anonymous page access. Servers that applied the June 9 fix are, according to Khoa, not exposed to that pre-auth path.
Exploit availability, prior use, and observed risk
No exploitation of CVE-2026-65660 has been publicly reported in the wild, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Microsoft’s advisory rates exploitation as unlikely. At the same time, Khoa’s full exploit markup is now public and he says he has used the exploit in penetration testing engagements.
The vulnerability sits in the same general space as previously disclosed SharePoint weaknesses: Khoa was the researcher who demonstrated the original ToolShell exploit chain at Pwn2Own Berlin in May 2025, a chain that was later exploited by Chinese state-backed groups and triggered emergency patches from Microsoft. Khoa has also disclosed several other SharePoint flaws, including CVE-2026-55040, an authentication bypass that attackers exploited shortly after its details became public in August.
What this means for technologists, affected enterprises, and defenders
- Technologists and security teams: apply the August 11 security update if not already installed; systems that applied the June 9 fix are no longer exposed to the pre-auth chaining path. Reassess triage decisions if they were based only on Microsoft’s original advisory descriptor.
- Affected enterprises and procurement leaders: identify deployed SharePoint Server versions, especially any instances of SharePoint 2013, which Khoa says is affected but which Microsoft does not list and which receives no security updates since April 2023.
- Defenders and incident responders: note that a working in-memory webshell payload exists in the public writeup and that the vulnerability can be chained with earlier bypasses; monitoring for anomalous usage of ToolPane/Register directives and unusual Xaml deserialization activity may be warranted.
The technical record published by Dinh Ho Anh Khoa changes the picture: what began in Microsoft's advisory as a spoofing issue now appears, in the public disclosure and in the updated CVE, to permit authenticated remote code execution. Patches are available and a pre-auth path was closed by a June 9 fix, but the public exploit material and the researcher's assertion that unsupported SharePoint 2013 is affected create concrete follow-on actions for administrators who must reconcile advisory language, CVE details, and applied patches.
