SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Researchers show SharePoint CVE-2026-65660 enables authenticated RCE, despite Microsoft first listing it as spoofing.
Viettel Cyber Security researcher Dinh Ho Anh Khoa published details showing CVE-2026-65660, which Microsoft's advisory called a spoofing issue scored 6.5, is authenticated remote code execution; NVD scores it 8.8 and both records cite CWE-94. SharePoint ToolPane rebuilds Register directives without escaping quotes, so an authorized attacker can register arbitrary .NET classes after the SafeControls check and execute code through XamlServices.Parse(), including an in-memory webshell. The bug affects SharePoint Server 2016, 2019, and Subscription Edition and was patched in the August 11 updates, which also disable the vulnerable function by default. No exploitation of CVE-2026-65660 is reported and it is not in CISA's KEV catalog; a separate authentication bypass, CVE-2026-55040, was fixed on June 9.
- Affects SharePoint Server 2016, 2019, and Subscription Edition; NVD scores it 8.8.
- Unescaped quotes in ToolPane Register directives bypass SafeControls and load arbitrary .NET classes.
- August 11 patches fix the bug and disable the vulnerable function by default.
- No in-the-wild exploitation reported and the flaw is not in CISA KEV.
- Pre-auth chaining needs a separate auth bypass that was fixed on June 9.
- Vendors
- Microsoft
- Products
- SharePoint Server
- Organizations
- Viettel Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6. 5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.