Microsoft SharePoint Flaw Lets Attackers Execute Code Remotely With Low Privileges

Microsoft has confirmed a high-severity remote code execution vulnerability in on-premises SharePoint Server that lets an authenticated, low-privileged attacker run arbitrary code over a network without user interaction.

Tracked as CVE-2026-65660, the code-injection flaw carries a CVSS score of 8.8 and affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Because SharePoint servers hold sensitive documents and operate with powerful service identities, successful exploitation could provide attackers with a foothold for credential theft, lateral movement, data exfiltration, and persistent access across environments.

The vulnerability was discovered by Viettel Cyber Security researcher Dinh Ho Anh Khoa, who described it as another bypass of SharePoint’s SafeControls protection.

SafeControls is designed to stop untrusted server-side classes from being instantiated while SharePoint parses page and Web Part markup.

The issue becomes exploitable when the ToolPane component processes attacker-controlled Register directives used to map tag prefixes to ASP.NET controls.

According to the technical analysis published by Viettel Cyber Security, ToolPane first separates Register directives from control markup and validates their type names. SharePoint then reconstructs those directives by placing attribute values inside double quotation marks.

Because embedded quotation marks are not safely escaped, a malicious value can alter the reconstructed directive conceptually similar to an injection flaw and introduce another directive after the relevant safety check but before ASP.NET parses the control.

This ordering error allows an attacker to register otherwise dangerous .NET classes and reach code-execution gadgets. Khoa demonstrated a chain involving XamlServices.Parse(), an ExpandedWrapper generic type, ObjectDataProvider, and LosFormatter deserialization.

Rather than writing a conventional webshell to disk, the technique can create an in-memory webshell, potentially reducing obvious filesystem artifacts and complicating incident response.

The public research contains working exploit markup, significantly lowering the barrier for reproduction.

Microsoft says exploitation requires authentication and only low-level access. However, the researcher showed that CVE-2026-65660 could be combined with a separate ToolPane authentication weakness to obtain pre-authentication RCE when a SharePoint deployment permits anonymous access to suitable pages.

That anonymous route was reportedly closed by Microsoft’s June 9, 2026 update, meaning patched systems should not expose the same pre-authentication chain.

Microsoft released fixes on August 11, 2026. Patched build levels are 16.0.5565.1001 for SharePoint 2016, 16.0.10417.20198 for SharePoint 2019, and 16.0.19725.20522 for Subscription Edition.

Microsoft’s advisory requires customer action and notes that organizations must install every applicable update package; SharePoint 2016 administrators may need both listed packages.

The researcher also reported that the underlying technique affects SharePoint 2013, which reached end of support in April 2023, although Microsoft’s official affected-product list covers only supported 2016, 2019, and Subscription Edition releases.

Organizations still operating SharePoint 2013 should therefore treat migration or isolation as urgent rather than wait for a security update that is unlikely to arrive.

At publication time, Microsoft said CVE-2026-65660 had not been publicly disclosed or exploited and rated exploitation as less likely. That assessment now deserves reassessment because detailed technical material is public.

Administrators should patch immediately, restrict internet and anonymous access, audit low-privilege accounts, and hunt for suspicious POST requests carrying unusual Web Part markup or encoded XAML.

Response teams should also examine worker-process behavior, unexpected child processes, anomalous assemblies, and volatile memory, since an in-memory implant may leave little or no webshell file on disk.

They should also preserve IIS, ULS, Windows event, PowerShell, and endpoint telemetry before restarting compromised SharePoint servers during investigation.