SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

1. Executive summary

CVE-2026-65660 is a code injection flaw in Microsoft SharePoint Server (2016, 2019, Subscription Edition) that Microsoft's August 2025 advisory initially presented as a spoofing issue scored 6.5, while the CVE record now titles it remote code execution and NVD scores it 8.8 HIGH (CWE-94). Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details on 2026-09-22, including a working in-memory webshell payload, and the flaw is exploitable by any authenticated attacker to execute arbitrary code. The flaw is not in CISA KEV, EPSS sits at 1%, and no exploitation in the wild has been reported, but the complete exploit markup is now public. EMEA financial services firms running on-premises SharePoint should verify they applied the 11 August 2026 security updates and re-triage any vulnerability-management decisions made against the original spoofing classification.

2. Regulatory framing

No NIS2 or UK NIS article is engaged beyond what any vulnerability advisory would trigger; the two DORA rows above rest on facts specific to this item, the vendor misclassification and the product's exploitation history.

3. Technical analysis & attack chain

Confirmed attack chain (authenticated path)

1. The attacker authenticates to the SharePoint server with any valid account. No special privileges are required beyond authentication; Microsoft's record describes an "authorized attacker."
2. The attacker submits web-part markup that the ToolPane component processes. When ToolPane reconstructs Register directives, it writes attribute values between double quotes without escaping quote characters inside those values.
3. The attacker closes the intended attribute with an injected double quote and appends additional Register directives of their choosing. These directives register arbitrary .NET classes.
4. The injected class registration lands after SharePoint's SafeControls check has already run but before the control is loaded. SafeControls is the allow-list that prevents dangerous classes from loading server-side; the injection defeats it by timing, not by bypassing the check itself.
5. With arbitrary class loading available, the attacker calls XamlServices.Parse() on attacker-controlled XAML. XAML deserialization reaches code execution.
6. Khoa's writeup includes a working in-memory webshell payload. He states it avoids the registry permission failures that other deserialization methods hit, which matters for defenders: the payload leaves no registry-based persistence artefact and no on-disk webshell file.

Pre-authentication chain (conditional, already closed by patch): Khoa demonstrated that the flaw chains with a separate authentication bypass to reach pre-authentication RCE on servers configured to allow anonymous page access. The bypass was fixed in a 9 June patch. Servers that applied that fix are not exposed to the pre-authentication path. This means the exposure check for any unpatched server is two-fold: is the August 11 SharePoint patch applied, and was the June 9 patch applied.

Scope and classification discrepancy: Microsoft's advisory lists SharePoint Server 2016, 2019, and Subscription Edition. Khoa says the flaw also affects SharePoint 2013, which has been out of support since April 2023 and receives no security updates; Microsoft's advisory does not list it. Firms still running SharePoint 2013 have no patch path and should treat those servers as exposed to a public, weaponised exploit chain. On classification: the advisory text describes spoofing with no integrity or availability impact at CVSS 6.5, while the CVE record (updated 11 September) and NVD both title it remote code execution at 8.8 HIGH, CWE-94 (Code Injection). Both records agree on CWE-94. The verified reference data confirms 8.8 HIGH, CWE-94, not in CISA KEV, EPSS 1%.

Exploitation status: No exploitation in the wild has been reported and the flaw is not in CISA KEV. Microsoft rates exploitation as unlikely. Against that, three facts raise the risk floor: the full exploit markup including the webshell payload is now public, Khoa states he has used the exploit in penetration-testing engagements, and the same researcher's earlier SharePoint disclosures in this product family were exploited shortly after details became public (CVE-2026-55040, an authentication bypass exploited shortly after its August disclosure; CVE-2026-45659, a deserialization RCE added to CISA KEV in July after active exploitation). The exploitation-history claim for those two CVEs is multi-source (The Hacker News, Help Net Security, Rapid7); the technical mechanism for CVE-2026-65660 itself is single-sourced to Khoa's writeup as reported by The Hacker News, and should be verified against the original publication before being used in enforcement actions.

Patch: The 11 August security updates fix the flaw. Khoa states the patch also turns the vulnerable function off by default, so patched servers get both the fix and a configuration-level defence.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory all on-premises SharePoint servers and record version and August 2026 patch level. The affected products are SharePoint Server 2016, 2019, and Subscription Edition. Any server without the 11 August 2026 security update is exposed to authenticated RCE with a public exploit.
• Confirm the 9 June 2026 patch is applied on every SharePoint server. Servers missing it and configured for anonymous page access are exposed to the pre-authentication chain, not just the authenticated one.
• Identify any SharePoint 2013 servers. There is no patch for this flaw on 2013; isolate them from untrusted networks and user-authenticated access immediately, and plan decommissioning.

P2 (within 72 hours)

• Apply the 11 August 2026 security updates to every affected SharePoint server that lacks them. Verify post-patch that the vulnerable ToolPane function is disabled by default, per Khoa's statement about the patch behaviour.
• Review vulnerability-management records for CVE-2026-65660. Any risk-acceptance or deferral decision taken against the original spoofing/6.5 classification is invalid and must be re-taken against the 8.8 RCE classification.
• Audit SharePoint web-part pages and solutions for unexpected Register directives or recently added .NET assemblies in the web application bin directories and the global assembly cache. The exploit works through class registration, so look for classes that are loaded but absent from the SafeControls list.

P3 (within 7 days)

• Restrict who can authenticate to SharePoint administration and content interfaces where web-part markup can be submitted. The authenticated path means every valid account is a potential initial vector; reduce the account population with access to sites where web parts can be edited.
• Disable anonymous page access on SharePoint web applications where it is not required, closing the precondition for the pre-authentication chain on any server that slips through patching.
• Add XamlServices.Parse() calls originating from SharePoint worker processes (w3wp.exe hosting SharePoint application pools) to ER monitoring as a high-signal detection, per §6.

5. Indicators of compromise

No indicators of compromise available in the source material. The published exploit is a markup-and-code technique, not a distributed malware sample, and the sources provide no hashes, domains, IPs, or file artefacts. The webshell payload described is in-memory, which further reduces the likelihood of file-based indicators.

Behavioural indicators

6. Detection

import "pe"

rule SHAREPOINT_CVE_2026_65660_XAML_WEBSHELL
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-22"
        reference = "https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html"
        description = "Detects XAML-based in-memory webshell payload delivered via CVE-2026-65660 ToolPane Register directive injection in SharePoint"
    strings:
        $xaml_parse = "XamlServices.Parse" ascii
        $xaml_ns = "<" ascii
        $reg_directive = "Register" ascii
    condition:
        uint16(0) == 0x5a4d and 2 of ($xaml_parse, $reg_directive) and $xaml_ns at 0
}

The YARA rule above is limited by what the sources contain. The writeup names XamlServices.Parse() and Register directives as the core artefacts, but no payload sample, hash, or literal XAML content is published in the source material, so the rule targets the technique strings only and should be treated as low-fidelity hunting support rather than an enforcement rule. The condition requires a PE file (the payload would be a .NET assembly) containing both the parse call and the directive string.

title: SharePoint XamlServices Parse from w3wp hosting SharePoint application pool
id: AT-2026-09-22-1006-01
status: experimental
description: >
  CVE-2026-65660 exploitation reaches code execution through XamlServices.Parse()
  on XAML supplied via injected Register directives in web-part markup. Observing
  that call from a SharePoint worker process is high-signal for this technique.
references:

  - https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html
author: Adverse Trace
date: 2026-09-22
logsource:
    category: process
    product: windows
detection:
    selection_process:
        Image|endswith: '\w3wp.exe'
    selection_call:
        CommandLine|contains: 'XamlServices.Parse'
    condition: selection_process and selection_call
falsepositives:

    - Legitimate SharePoint custom solutions using XAML deserialization, which should be rare and enumerable
level: high

CVE assessment

1 referenced CVE

7. Sources

• The Hacker News, "SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE," https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html, 2026-09-22
• The Hacker News, "Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions," https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html, May 2026
• Help Net Security, "High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)," https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/, 2026-05-26
• The Hacker News, "SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation," https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html, July 2026
• The Hacker News, "Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE," https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html, August 2026
• Rapid7 Blog, "CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)," https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed, August 2026
• ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Sharepoint (22 juillet 2026)," https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/, 2026-07-22

8. Adverse Trace position

We assess CVE-2026-65660 as a high-severity exposure for any EMEA financial services firm running on-premises SharePoint Server 2016, 2019, or Subscription Edition without the 11 August 2026 patch, on the verified 8.8 HIGH classification, notwithstanding Microsoft's original spoofing presentation and its current "unlikely" exploitation rating. The verified data places it outside CISA KEV with EPSS at 1%, so we are not treating it as an active incident, but the public exploit markup, the in-memory webshell payload, the researcher's confirmed use of the exploit in engagements, and this product family's record of post-disclosure exploitation (CVE-2026-45659 in KEV, CVE-2026-55040 exploited after disclosure) justify patch verification as an immediate action rather than a routine cycle item. The technical mechanism is single-sourced to Khoa's writeup as reported by The Hacker News; we will verify the detail against the original publication and the Microsoft CVE record, and we will monitor CISA KEV, EPSS movement, and vendor telemetry for any exploitation signal. If exploitation is confirmed, we will reissue this advisory with an elevated priority and incident-response guidance.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.