Microsoft SharePoint Flaw Reclassified as RCE After Initial Underestimation
A SharePoint Server vulnerability, CVE-2026-65660, initially downplayed by Microsoft as a spoofing issue, has been detailed by researchers as enabling authenticated remote code execution.
A critical vulnerability in Microsoft SharePoint Server, identified as CVE-2026-65660, has been re-evaluated by security researchers, revealing its true potential for authenticated remote code execution (RCE). Initially categorized by Microsoft as a mere spoofing flaw with a moderate CVSS score of 6.5, the vulnerability's actual impact has been demonstrated to be far more severe, with the National Vulnerability Database now assigning it a score of 8.8.
The flaw affects multiple versions of SharePoint Server, including 2016, 2019, and the Subscription Edition. While Microsoft released patches for this vulnerability on August 11, 2026, the discrepancy in its initial classification highlights a potential blind spot in how certain vulnerabilities are triaged and communicated. Microsoft's own advisory described the issue as allowing an authorized attacker to perform spoofing, with no impact on integrity or availability. However, a separate CVE record, updated later, explicitly labels it a remote code execution vulnerability.
Technical analysis by Viettel Cyber Security researcher Dinh Ho Anh Khoa, who previously demonstrated exploits against SharePoint at Pwn2Own Berlin, reveals the vulnerability lies within the ToolPane component's handling of web-part markup. Specifically, the component reconstructs Register directives by writing attribute values between double quotes without properly escaping any quotes contained within them. This oversight allows an attacker to inject additional directives, effectively registering arbitrary .NET classes.
Once arbitrary class loading is achieved, an attacker can leverage XamlServices.Parse() to trigger code execution through deserialization. Khoa's research includes a working in-memory webshell payload designed to bypass common permission failures encountered with other deserialization techniques. This mechanism allows an authenticated attacker to gain control over the affected SharePoint server.
Furthermore, Khoa demonstrated that CVE-2026-65660 can be chained with a previously patched authentication bypass vulnerability. This chaining could potentially lead to pre-authentication remote code execution on servers that permit anonymous page access. However, this pre-authentication attack vector is mitigated if the June 9 patch, which fixed the authentication bypass, has been applied.
While no exploitation of CVE-2026-65660 has been reported in the wild, and it has not yet been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, the public availability of the full exploit details increases the risk. Microsoft's advisory rated exploitation as unlikely, but the researcher has confirmed using the exploit in penetration testing engagements.
The August 11 patch is understood to fix the vulnerability by disabling the vulnerable function by default. It is important to note that Khoa also indicated that SharePoint 2013 is affected by this flaw, although it is not listed in Microsoft's advisory. As SharePoint 2013 is out of support since April 2023, it will not receive security updates, leaving it permanently vulnerable.
This incident underscores the importance of thorough vulnerability analysis and accurate classification, as underestimating a flaw's potential impact can leave organizations exposed. The technical details now publicly available serve as a critical reminder for administrators to ensure all SharePoint servers are updated with the latest security patches.
This new report provides critical technical details on CVE-2026-65660, including a demonstration of how the vulnerability can be chained with an authentication weakness to achieve pre-authentication RCE on anonymously accessible sites. It also highlights the potential for in-memory webshell creation, which could complicate incident response efforts.