CVE-2026-65660 turns Microsoft’s SharePoint ‘spoofing’ flaw into remote code execution

August 11, 2026. Microsoft patches CVE-2026-65660 in its monthly security updates, describing it as a spoofing vulnerability rated CVSS 6.5, with no impact on integrity or availability. September 22, 2026. Researcher Dinh Ho Anh Khoa of Viettel Cyber Security publishes full technical details: the flaw actually enables authenticated remote code execution. September 25, 2026. CISA adds CVE-2026-65660 to its KEV catalog, and Microsoft acknowledges it has “reliable evidence of observed attacks.” Why it matters: teams triaged this flaw for more than a month as a cosmetic issue, while it opens a code-execution path on SharePoint servers.

A classification gap that poisons triage

Vulnerability triage depends on trusting the vendor’s description. CVE-2026-65660 shows how misleading that trust can be. The Microsoft advisory described an “authorized” spoofing issue at CVSS 6.5, assigning no impact to integrity or availability. Yet the CVE record Microsoft publishes separately, updated on September 11, 2026, titles the same flaw a “remote code execution” vulnerability and states it lets an authorized attacker execute code. Both records carry the same CWE-94 weakness, code injection.

Defenders who triaged CVE-2026-65660 from the initial advisory saw a moderate spoofing flaw, not a code-execution vulnerability with the CVSS 8.8 score assigned by NVD. The lesson is simple: for Microsoft products, the bulletin and the CVE record must be read together, because they can diverge for weeks.

The practical cost is concrete. CVSS scores drive automated patching SLAs and risk-scoring pipelines; a 6.5-spoofing tag parks the flaw in a low-priority queue, while an 8.8 RCE score would have triggered emergency patching. That gap is precisely the window an attacker needs: from the August 11 patch to the September 25 KEV addition, any team that trusted the advisory over the CVE record was running a code-execution flaw as if it were cosmetic. Microsoft’s September 11 update to its own CVE record — retitling the flaw to RCE — did not trigger a coordinated re-notification. For SharePoint operators, the NVD entry, not the bulletin, is the authoritative source; the two can disagree for weeks, and the disagreement always costs the defender.

The mechanism: quotes that let directives slip through

The flaw sits in how SharePoint checks whether server-side controls are on the SafeControls list — a filter that stops dangerous classes from loading. When the ToolPane component processes web-part markup, it reconstructs Register directives by writing attribute values between double quotes, without escaping the quotes already inside those values.

An attacker can therefore inject additional directives through the unescaped quotes. The type check runs first, and then arbitrary classes are registered before the control loads. Once arbitrary class loading is achieved, the attacker uses XamlServices.Parse() to trigger code execution through deserialization — a classic .NET deserialization-gadget technique, applied here to the very core of web-part rendering.

The writeup includes a working in-memory webshell payload that sidesteps the registry permission failures other deserialization methods hit. Khoa says he has used the exploit in real penetration tests. The August 11 patch fixes the flaw and turns off the vulnerable function by default.

A researcher who knows this ground

Dinh Ho Anh Khoa is no stranger to this terrain: he demonstrated the original ToolShell chain against SharePoint at Pwn2Own Berlin in May 2025. That chain was later exploited by state-backed groups and triggered emergency patches from Microsoft. He has since disclosed several other SharePoint flaws, including CVE-2026-55040, an authentication bypass exploited shortly after its details became public in August 2026.

That pedigree changes the risk calculus. A SharePoint flaw detailed by this researcher has historically been followed by rapid in-the-wild exploitation — which the KEV addition on September 25 now confirms.

The pre-authentication chaining

Khoa also demonstrated that CVE-2026-65660 can be chained with a separate, already-patched authentication bypass to reach pre-authentication remote code execution on servers configured to allow anonymous page access. That bypass was fixed in the June 9 patch, and servers that applied it are not exposed to the pre-auth path.

This means the real severity depends on each server’s patch state: a server patched in June is still exposed to authenticated RCE, while a server unpatched since June that allows anonymous access becomes a target for unauthenticated RCE. To check a farm’s patch level, the following command returns the build version:

(Get-SPFarm).BuildVersion

The flaw affects SharePoint Server 2016, 2019 and Subscription Edition. Khoa notes it also affects SharePoint 2013, though the Microsoft advisory lists only the three supported editions — SharePoint 2013 has been out of support since April 2023 and receives no further patches.

Exploitation now officially acknowledged

The status flip happened within days. On September 22, full technical details are public, but no exploitation is reported and the flaw is not in the KEV. On September 25, Microsoft notes: “As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.” Microsoft has not disclosed who is behind the attacks, when they began, how many organizations have been targeted, or what the attackers did once inside.

CISA reacted the same day by adding CVE-2026-65660 to the KEV, with a remediation due date of September 28, 2026 for US federal agencies — a strong signal, since KEV inclusion requires confirmed active exploitation. For teams still treating CVE-2026-65660 as a spoofing issue to patch “when there’s time,” the window has closed.

Detecting exploitation that already happened

Khoa’s payload is an in-memory webshell, with no file dropped to disk. Antivirus and file-integrity tools — which compare on-disk hashes — will miss it. Detection has to happen elsewhere: in SharePoint’s ULS logs, in control-loading events, and in the history of recently added web parts.

Exploiting CVE-2026-65660 goes through the registration of arbitrary .NET classes via injected Register directives. In practice, audit the SafeControls entries for unusual controls, review web parts deployed since August 11, and correlate with the access logs of servers that allow anonymous access. A patched but already exploited server remains compromised: the fix does not evict a class already loaded in memory, so treat a suspected exploit as a full incident and rebuild rather than assume the patch cleaned it.

Verdict

If you run SharePoint Server 2016, 2019 or Subscription Edition, apply the August 11 patch immediately if you have not already, and check the build level with (Get-SPFarm).BuildVersion — the real severity (authenticated RCE, potentially pre-authentication) far exceeds the initial CVSS 6.5. If your servers allow anonymous page access, treat yourself as critical and consider the June 9 patch a prerequisite on par with the August one. If you triage flaws on the vendor bulletin alone, add a standing check: cross-reference the advisory with the updated CVE record and with the KEV, because Microsoft just showed that a displayed spoofing can be a real RCE. CVE-2026-65660 is less a story about code than about trust — and trust in security metadata has just cost many teams a month of triage.

References

• The Hacker News — SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE (September 22, 2026)
• The Hacker News — SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild (September 26, 2026)
• NVD — CVE-2026-65660
• CISA — Known Exploited Vulnerabilities Catalog