Full Report
A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition. Patches have been
Analysis Summary
# Vulnerability: SharePoint Server Authenticated Remote Code Execution
## CVE Details
- CVE ID: CVE-2026-65660
- CVSS Score: 8.8 (National Vulnerability Database); initially classified by Microsoft as 6.5
- CWE: CWE-94 (Code Injection)
## Affected Systems
- Products: Microsoft SharePoint Server
- Versions: SharePoint Server 2016, 2019, and Subscription Edition. The researcher notes it also affects SharePoint 2013 (which is out of support).
- Configurations: Vulnerable functions are on by default prior to patching. Additionally, servers configured to allow anonymous page access can be exposed to a pre-authentication remote code execution path if chained with a separate, already-patched June 9 authentication bypass.
## Vulnerability Description
The flaw resides in how SharePoint verifies whether server-side controls are included on the SafeControls list, which acts as a filter to prevent dangerous classes from loading. When the ToolPane component processes web-part markup, it reconstructs Register directives by writing attribute values between double quotes without escaping quotes inside them.
An attacker can exploit this by injecting additional directives through the unescaped quotes. This allows the registration of arbitrary .NET classes after the type check runs but before the control is loaded. Once arbitrary class loading is achieved, the attacker utilizes `XamlServices.Parse()` to trigger remote code execution via deserialization.
## Exploitation
- Status: PoC available (Full exploit markup is public; a working in-memory webshell payload has been demonstrated, and the researcher has utilized it in penetration testing. No exploitation in the wild has been reported).
- Complexity: Not specified
- Attack Vector: Network (Remote)
## Impact
- Confidentiality: High (Enables remote code execution)
- Integrity: High (Enables remote code execution; though Microsoft's initial spoofing advisory assigned no impact to integrity)
- Availability: High (Enables remote code execution; though Microsoft's initial spoofing advisory assigned no impact to availability)
## Remediation
### Patches
- Microsoft August 11 security updates patch the flaw and turn off the vulnerable function by default.
- Note: SharePoint 2013 has been out of support since April 2023 and receives no security updates.
### Workarounds
- Not specified in the text.
## Detection
- Indicators of compromise: The published exploit utilizes a working in-memory webshell payload designed to avoid the registry permission failures typically encountered by other deserialization methods.
- Detection methods and tools: Not specified in the text.
## References
- Microsoft Security Advisory: `hxxps[:]//msrc[.]microsoft[.]com/update-guide/en-US/vulnerability/CVE-2026-65660`
- Microsoft August 11 Security Updates: `hxxps[:]//support[.]microsoft[.]com/en-us/servicing/office/hotfix/august/5002893`
- Viettel Cyber Security Research Blog: `hxxps[:]//blog[.]viettelcybersecurity[.]com/sharepoint_cve-2026-65660/`