Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code
CVE-2026-65660 allows authenticated low-privilege users to execute arbitrary code on vulnerable on-premises Microsoft SharePoint servers via a SafeControls bypass.
CVE-2026-65660 is an authenticated remote code execution vulnerability in Microsoft SharePoint Server 2016, 2019, and Subscription Edition. It allows low-privileged users to bypass SafeControls protections via a parsing flaw in the ToolPane logic, enabling the deployment of fileless webshells through .NET deserialization. Microsoft released patches on August 11, 2026, and while no exploitation has been confirmed, the detailed research warrants immediate remediation.
- Authenticated low-privilege users can achieve remote code execution on on-premises SharePoint servers.
- Vulnerability stems from a SafeControls validation bypass in the ToolPane parsing logic.
- Proof-of-concept uses .NET deserialization to deploy fileless, in-memory webshells.
- Pre-authentication compromise possible if anonymous access is enabled for certain pages.
- Patched by Microsoft on August 11, 2026; no public exploitation reported yet.
- CVEs
- CVE-2026-65660
- Tags
- authenticated-rcecve-2026-65660deserializationmicrosoftremote-code-executionsafecontrols-bypasssharepoint
- Vendors
- Microsoft
- Organizations
- MicrosoftViettel Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
From the original article
2 min read at gbhackers.com
A detailed Microsoft SharePoint vulnerability, tracked as CVE-2026-65660, allows authenticated, low-privileged users to execute arbitrary code on vulnerable on-premises SharePoint servers. Initially categorized as a spoofing issue, technical analysis shows this flaw can be exploited for authenticated remote code execution (RCE), including deploying fileless, in-memory webshells.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.