Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code

A detailed Microsoft SharePoint vulnerability, tracked as CVE-2026-65660, allows authenticated, low-privileged users to execute arbitrary code on vulnerable on-premises SharePoint servers.

Initially categorized as a spoofing issue, technical analysis shows this flaw can be exploited for authenticated remote code execution (RCE), including deploying fileless, in-memory webshells.

Viettel Cyber Security researcher Dinh Ho Anh Khoa reported that the vulnerability arises from a SafeControls validation bypass in SharePoint’s ToolPane processing logic.

It affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Microsoft released security updates on August 11, 2026.

Microsoft SharePoint Flaw

The vulnerability lies in the handling of server-side control markup processed through the ToolPane.GetPartPreviewAndPropertiesFromMarkup() function.

SharePoint uses EditingPageParser.VerifyControlOnSafeList() to confirm that registered controls and types are permitted by its SafeControls protections.

However, the vulnerable process separates Register directives from tag markup, processes them individually, and later combines the results before parsing the final content.

According to the researcher, insecure handling of quotation marks in Register directive attributes allows an attacker to inject or alter directives after the initial validation.

This type-check bypass enables the registration of potentially dangerous namespaces or classes that should normally be blocked. The attack exploits the difference between validation-time processing and final parsing, allowing malicious directives to evade SharePoint’s intended SafeControls restrictions.

The proof-of-concept chain described by the researcher utilizes .NET parsing and deserialization functionality to achieve arbitrary code execution. Specifically, it can exploit XamlServices.Parse() along with ObjectDataProvider and LosFormatter deserialization mechanisms.

Rather than writing a conventional webshell to disk, an attacker could create an in-memory webshell within the SharePoint worker process. This is particularly concerning, as memory-resident implants can reduce forensic visibility and may evade file-based security controls.

The researcher noted that SharePoint’s design-time parsing behavior limits some traditional ASP.NET lifecycle abuse techniques, such as execution through OnInit or OnLoad.

Nevertheless, the available parsing path is adequate to load dangerous .NET classes and trigger code execution through gadget-based deserialization techniques.

CVE-2026-65660 is primarily an authenticated RCE vulnerability. However, the researcher highlighted a potential avenue for pre-authentication compromise when SharePoint is configured to allow anonymous access to pages.

In such a scenario, an attacker may target a page that inherits from WebPartPage and contains a Web Part zone. SharePoint can initialize the ToolPane on this page without routing the request through the authentication check used by ToolPanePage.

This attack relies on anonymous page access being enabled, a configuration sometimes used for public-facing SharePoint deployments.

Organizations should immediately apply Microsoft’s security updates from August 11, 2026, across all affected servers. The reported patched build levels include turning off the vulnerable ToolPane parsing function by default.

Administrators should also review anonymous-access settings, monitor SharePoint worker processes for unusual child-process activity, investigate unexpected requests to Web Part and gallery pages, and look for abnormal .NET deserialization behavior.

As of September 22, 2026, no confirmed real-world exploitation has been publicly reported. However, given the availability of detailed exploitation research, rapid remediation is essential.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC