← Back to Feed CACHED · 2026-10-24 03:51:32 · CACHE_KEY CVE-2026-65660
CVE-2026-65660 · CWE-94 · Disclosed 2026-08-11

Microsoft SharePoint Server Register directive code injection via SafeControls bypass

ASSESSED — NOISGATE
Vendor
—
—
—
Reassessed
—
—
—
Verdict: —
Do you agree?
01 · The Real Story

A front door that opens with any employee badge and lets the intruder hide inside the walls

CVE-2026-65660 is a code injection vulnerability in on-premises Microsoft SharePoint Server — Subscription Edition, 2019, and 2016 — that grants any authenticated user with Site Member access full remote code execution on the server. The flaw sits in SharePoint's ToolPane component (EditingPageParser), which reconstructs ASP.NET Register directives by writing attribute values between double quotes without escaping embedded quotes. An attacker injects a rogue Register directive that slips past the SafeControls type check, then triggers XamlServices.Parse() deserialization to run arbitrary code entirely in memory — no file is ever written to disk. SharePoint 2013 is vulnerable but end-of-life with no patch. SharePoint Online / Microsoft 365 is not affected.

Microsoft's 8.8 HIGH score undersells the real-world picture, and its own classification history is damning: the vendor originally shipped this as a *spoofing* flaw in August, then quietly revised it to code injection only after exploitation surfaced. Three factors push reality beyond the label. First, exploitation is confirmed in the wild — CISA issued a 3-day KEV deadline on 2026-09-25, the most aggressive SLA they have. Second, a public Python PoC (ShadowForge-Cyber) and Viettel Security's detailed write-up mean any attacker with a SharePoint account and a terminal can reproduce the chain. Third, the fileless execution technique means defenders relying on file-integrity monitoring or signature-based AV are flying blind — only process-behavioral EDR or memory forensics can catch it. The vendor score doesn't account for any of this.

"Actively exploited SharePoint RCE with public PoC and fileless execution earns CRITICAL, not vendor's HIGH."
02 · The Attack Path

5 steps from start to impact.

STEP 01

Acquire low-privilege SharePoint credentials

The attacker needs any valid SharePoint account with at least Site Member permissions. In enterprise environments, SharePoint credentials match Active Directory accounts, so phished, leaked, or brute-forced credentials from any employee suffice. Alternatively, if the target SharePoint web application permits anonymous access, the attacker chains with a separate anonymous-delivery weakness to skip authentication entirely.
Conditions required:
  • Target SharePoint Server is network-reachable (internet or internal)
  • Attacker possesses or can obtain valid AD/SharePoint credentials, OR target allows anonymous access
Where this breaks in practice:
  • Requires a valid account for the standalone chain — limits opportunistic drive-by exploitation
  • MFA on SharePoint login reduces credential-stuffing success rates
Detection/coverage: Failed authentication attempts visible in Windows Security Event Log (Event ID 4625) and SharePoint ULS logs. Anomalous logon volume from unusual geolocations may trigger SIEM correlation rules.
STEP 02

POST crafted payload to ToolPane layout endpoint

The attacker sends two sequential POST requests to /_layouts/15/AddGallery.aspx or /_layouts/15/designgallery.aspx with the DisplayMode=Edit query parameter. The requests populate the MSOTlPn_Uri and MSOTlPn_DWP form fields with a payload containing injected quote characters. The ShadowForge-Cyber Python PoC (exploit.py) automates this entire sequence end-to-end.
Conditions required:
  • Valid authenticated session on the SharePoint site
  • Knowledge of target endpoint URLs (publicly documented in PoC and write-ups)
Where this breaks in practice:
  • WAF or reverse proxy can inspect and block POST to known layout pages with DisplayMode=Edit
  • Virtual patch rulesets for AWS WAF, Cloudflare, and ModSecurity published 2026-10-01
Detection/coverage: IIS W3C logs record POST requests to /_layouts/15/AddGallery.aspx?DisplayMode=Edit and /_layouts/15/designgallery.aspx?DisplayMode=Edit. These URL patterns are strong exploitation indicators and should trigger high-fidelity alerts.
STEP 03

SafeControls type-check bypass via unescaped quote injection

The ToolPane component reconstructs Register directives by inserting attribute values between double quotes, but does not escape embedded quotes in attacker input. This allows the attacker to break out of the attribute context and inject an additional Register directive that registers an arbitrary .NET class. The injected type passes the SafeControls validation because the type check runs *before* the directive string is split and re-parsed — the malicious type only materializes afterward.
Conditions required:
  • Unpatched SharePoint Server (pre-August 2026 security update)
  • ToolPane parsing function is active (the patch disables it)
Where this breaks in practice:
  • The August 2026 patch disables the vulnerable ToolPane function entirely
  • No known bypass of the patched code path has been published
Detection/coverage: SharePoint ULS logs may record parsing errors or unusual Register directive processing in the EditingPageParser category. Correlation with Step 2 IIS log entries strengthens confidence.
STEP 04

XamlServices.Parse() deserialization executes attacker XAML

The injected Register directive loads a .NET class that invokes XamlServices.Parse() with an attacker-controlled XAML payload. This is a well-understood deserialization gadget in the .NET Framework that instantiates arbitrary objects and executes code. The payload runs in the security context of the SharePoint application pool identity — typically a domain service account with SQL Server access, Kerberos delegation, and SPNs.
Conditions required:
  • .NET Framework 4.8+ present on the server (standard on supported Windows Server builds)
  • Successful Register directive injection from Step 3
Where this breaks in practice:
  • Minimal — XamlServices.Parse is a standard, well-documented .NET deserialization sink
  • No AppLocker or WDAC policy applies inside the w3wp.exe managed process by default
Detection/coverage: ETW traces from the .NET CLR runtime may capture unusual XAML object instantiation. Microsoft Defender for Endpoint behavioral sensors may flag anomalous XamlServices.Parse invocation patterns in w3wp.exe.
STEP 05

Establish in-memory shell or persistent webshell

With code execution achieved, observed attacks deploy either an in-memory webshell (loaded as a managed assembly in w3wp.exe, surviving until application pool recycle) or a persistent ASPX webshell at /_layouts/15/sphealth.aspx. The fileless variant leaves zero file artifacts. The attacker gains full control over the SharePoint farm, can exfiltrate the entire document corpus, harvest credentials from the content database, or pivot laterally using the service account's AD permissions and SQL Server connectivity.
Conditions required:
  • Successful code execution from Step 4
  • Outbound network connectivity for C2 is optional — the webshell provides interactive access via HTTP
Where this breaks in practice:
  • The in-memory variant leaves no file artifacts, complicating forensics and detection
  • The persistent ASPX webshell is detectable by FIM, but the fileless variant is not
Detection/coverage: Hunt for /_layouts/15/sphealth.aspx or any unexpected .aspx files in the SharePoint layouts directory. Monitor w3wp.exe for child process creation (cmd.exe, powershell.exe, certutil.exe). Process-behavioral EDR detection is the primary sensor surface for the fileless variant.
03 · Compensating Control

1
CRITICAL 9.1→IGNORE 0.0
SEVERITY REDUCED
Apply August 2026 security updates (KB5002893 / KB5002894+KB5002896 / KB5002905+KB5002906) — The definitive remediation. The patch disables the vulnerable ToolPane parsing function entirely, eliminating the attack surface. Deploy within 3 days per the noisgate CRITICAL mitigation SLA — this aligns with CISA's own 3-day KEV deadline. Test in a non-production farm first if possible, but do not let testing delay production patching beyond the SLA given confirmed active exploitation.
2
CRITICAL 9.1→HIGH 7.5
SEVERITY REDUCED
Remove internet-facing SharePoint exposure immediately — If any SharePoint farm is accessible from the public internet, place it behind VPN, ZTNA gateway, or Azure AD Application Proxy today. This eliminates exploitation by external attackers and constrains the threat to internal users with valid credentials — a dramatically smaller population. Deploy within 3 days per the noisgate CRITICAL mitigation SLA. This is the highest-impact interim control if patching requires a maintenance window.
3
CRITICAL 9.1→HIGH 7.0
SEVERITY REDUCED
Deploy WAF virtual patches blocking POST to exploitation endpoints — Create rules that block or quarantine POST requests to /_layouts/15/AddGallery.aspx and /_layouts/15/designgallery.aspx when the query string contains DisplayMode=Edit. Virtual patch rulesets for AWS WAF, Cloudflare, and ModSecurity were published 2026-10-01. This breaks the *known* exploitation path but cannot guarantee coverage of alternative layout page injection points. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
4
CRITICAL 9.1→CRITICAL 8.8
Disable anonymous access on all SharePoint web applications — In SharePoint Central Administration → Web Application Management → Authentication Providers, verify anonymous access is disabled on every web application. This eliminates the pre-authentication exploitation chain that bypasses the PR:L requirement. The standalone authenticated vector is unchanged. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
5
CRITICAL 9.1→CRITICAL 9.1
Hunt for post-exploitation IOCs across all SharePoint farms — Search IIS W3C logs for POST requests to /_layouts/15/AddGallery.aspx?DisplayMode=Edit or /_layouts/15/designgallery.aspx?DisplayMode=Edit. Enumerate the /_layouts/15/ directory for unexpected .aspx files — specifically sphealth.aspx. Monitor w3wp.exe for anomalous child process creation (cmd.exe, powershell.exe, certutil.exe). If any IOC is confirmed, isolate the server and initiate IR immediately. This is detection/response only and does not prevent exploitation. Execute immediately.
What doesn't work
  • SharePoint site-level permission restrictions — The exploit targets endpoints in the /_layouts/15/ virtual directory, which is accessible to all authenticated users regardless of site-level permission trimming. Restricting a SharePoint site's members list does not prevent a valid AD-authenticated user from reaching the vulnerable endpoint.
  • File integrity monitoring (FIM) on SharePoint web roots — The primary exploitation variant executes entirely in memory as a managed assembly loaded into w3wp.exe, writing zero files to disk. FIM will catch the less-sophisticated persistent webshell variant (sphealth.aspx) but completely miss the fileless one, which is the technique documented in current attacks.
  • Standard antivirus / Windows Defender real-time scanning — The XAML deserialization payload executes within the w3wp.exe managed .NET process without touching disk. Signature-based AV has no file artifact to scan and no known behavioral signature for the in-memory assembly loading pattern.
  • Network-level IDS/IPS without TLS inspection — All SharePoint traffic is encrypted via TLS. Suricata, Snort, or Zeek cannot inspect the POST payload to match exploitation signatures unless TLS is terminated and inspected at a reverse proxy or WAF layer upstream.
04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitationConfirmed. Microsoft acknowledged reliable evidence of attacks on 2026-09-25. Previdian honeypots recorded 20 exploitation attempts from 5 unique IPs across GB, IL, and US between Sep 24–30. Post-exploitation activity includes webshell deployment (sphealth.aspx) in the SharePoint layouts directory. No named threat actor or ransomware group attributed yet.
CISA KEV statusListed 2026-09-25. Federal remediation deadline: 2026-09-28 (3-day window — CISA's most aggressive SLA). KEV entry.
Proof-of-concept availabilityPublic. ShadowForge-Cyber/CVE-2026-65660-Poc — Python 3.10+ exploit automating the full Register directive injection → XamlServices.Parse() deserialization chain. Viettel Security published a detailed technical analysis in late September 2026, and blacktree.nl documented the in-memory shell technique. Virtual patch signatures for AWS WAF, Cloudflare, and ModSecurity published 2026-10-01.
EPSS0.02101 (~2.1% probability of exploitation in next 30 days). Note: EPSS was calculated before KEV listing and active exploitation confirmation — the model almost certainly underweights this CVE given current real-world activity.
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 HIGH. Network-reachable, low complexity, low-privilege authentication required (any Site Member), no user interaction needed. Full C/I/A impact within the SharePoint process scope. The PR:L is the only meaningful friction encoded in the vector.
Affected versionsSharePoint Server Subscription Edition (all builds < 16.0.19725.20522), 2019 (all builds < 16.0.10417.20198), 2016 (all builds < 16.0.5565.1001). SharePoint 2013 is vulnerable but end-of-life — no patch will be issued. SharePoint Online (Microsoft 365) is not affected.
Fixed versions and KBsSubscription Edition: KB5002893 → 16.0.19725.20522. 2019: KB5002894 + KB5002896 → 16.0.10417.20198. 2016: KB5002905 + KB5002906 → 16.0.5565.1001. All released 2026-08-11 (August Patch Tuesday).
Internet-facing exposureShadowserver tracks ~10,000 internet-facing SharePoint Server instances globally. Shodan/Censys queries return up to 30,000 hosts. US has the highest concentration. Previous SharePoint CVEs found 1,300+ servers still unpatched weeks post-fix. Scanning for this CVE was observed by Previdian starting 2026-09-24.
Disclosure timeline2026-08-11: Patch released (Patch Tuesday); Microsoft initially labels as *spoofing*. ~2026-09-20: Viettel Security publishes technical details. 2026-09-22: Public PoC disclosed. 2026-09-24: First exploitation observed (Previdian). 2026-09-25: CISA adds to KEV; Microsoft confirms active exploitation, revises classification to code injection.
Reporting researcherDinh Ho Anh Khoa of Viettel Cyber Security. Responsible disclosure to Microsoft; technical details published post-patch, with weaponized exploitation following within days.

Sources.

  1. CISA KEV Catalog — CVE-2026-65660
  2. CISA Alert — Two KEVs Added (2026-09-25)
  3. SecurityWeek — SharePoint Flaw Now Exploited in Attacks
  4. ShadowForge-Cyber PoC — CVE-2026-65660
  5. Blacktree — SharePoint CVE-2026-65660 Memory Shell Analysis
  6. Previdian — CVE-2026-65660 Exploitation Telemetry
  7. Canadian Centre for Cyber Security — AL26-023
  8. NHS England — CC-4859 Cyber Alert
05 · The Call

Final Verdict
↑ UPGRADED to CRITICAL (9.1/10)

Why this verdict

  • Active exploitation confirmed: CISA KEV-listed on 2026-09-25 with a 3-day remediation deadline — the most aggressive SLA CISA issues. Previdian honeypots captured 20 exploitation attempts across three countries within one week. Microsoft itself confirmed reliable evidence of attacks. This is not theoretical risk.
  • Public PoC eliminates attacker skill barrier: ShadowForge-Cyber's Python exploit and Viettel Security's detailed technical write-up mean any attacker with network access and a SharePoint account can achieve RCE. The exploit automates the full chain from authentication through in-memory shell deployment. The window between PoC publication and in-the-wild exploitation was measured in *days*.
  • Fileless execution creates a critical detection blind spot: The in-memory webshell technique — loading a managed assembly directly into w3wp.exe with no file on disk — means defenders relying on file-integrity monitoring, standard AV, or webshell file scanners will miss active compromise entirely. Only process-behavioral EDR or memory forensics provides coverage. This is a qualitative gap the CVSS score cannot express.
  • Role multiplier: SharePoint Server is a canonical enterprise document and collaboration platform. ≥90% of on-premises deployments hold business-critical data (HR records, legal documents, financial reports, intellectual property). RCE on a SharePoint farm = immediate access to the entire document corpus and the SharePoint content database via SQL. The SharePoint application pool identity is typically a domain service account with Kerberos constrained delegation, SPNs, and direct SQL Server db_owner access, creating a lateral movement highway to database tiers and potentially Active Directory. The blast radius is host → farm → data tier → mass data egress, and in environments with unconstrained delegation, extends to domain compromise. This qualifies as mass data egress for ≥1% of the installed base (easily — SharePoint is in virtually every Fortune 2000), setting a verdict floor of HIGH. With active exploitation and detection evasion, the verdict clears above the floor to CRITICAL.
  • Microsoft's classification history is a severity red flag: The vendor originally shipped this as a *spoofing* bug, then revised to code injection only after real-world exploitation forced their hand. The 8.8 is itself a reluctant upward correction — it still underweights the operational reality.
  • Pre-auth chain amplifier: SharePoint web applications configured for anonymous access — common on partner portals, public intranets, and extranet sites — can be exploited without any credentials by chaining CVE-2026-65660 with a separate anonymous-delivery weakness. This eliminates the PR:L friction entirely for a non-trivial subset of deployments.

Why not higher?

A 10.0 would require pre-authentication exploitation as the *default* condition, which it is not — the standalone CVE requires low-privilege authentication (PR:L), and the pre-auth chain depends on a non-default misconfiguration (anonymous access enabled). The scope is unchanged (code runs within the SharePoint w3wp.exe application pool, not a hypervisor or OS-level escape). The 9.1 reflects confirmed exploitation, public PoC, and a severe detection gap while acknowledging the authentication requirement as genuine friction that prevents mass-automated scanning from instantly compromising every unpatched farm.

Why not lower?

Downgrading to HIGH would ignore three converging real-world amplifiers that the CVSS base score structurally cannot express: (1) active, confirmed exploitation with CISA's most aggressive deadline; (2) a near-zero attacker skill barrier from fully weaponized public tooling; and (3) a fileless execution technique that defeats the most common SharePoint monitoring strategies. CISA's independent 3-day deadline — reserved for the highest-urgency threats — corroborates the CRITICAL assessment. SharePoint's universal deployment as an enterprise document platform means successful exploitation yields mass data egress of regulated and sensitive content, and the service account's AD footprint creates lateral movement paths that amplify blast radius well beyond the compromised host.

06 · Verification

Crowdsourced verification payload.

Run on each SharePoint server as a local administrator. Execute with: powershell -ExecutionPolicy Bypass -File .\Check-CVE202665660.ps1. No network access or SharePoint farm connectivity required — the script reads the local Microsoft.SharePoint.dll file version and compares against patched baselines.

noisgate-verify.ps1
POWERSHELLREAD-ONLYSAFE
<#
.SYNOPSIS
  CVE-2026-65660 - Microsoft SharePoint Server Code Injection
  Compares installed SharePoint build against patched baselines.
  Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>
$ErrorActionPreference = 'Stop'
try {
    $dll16 = Join-Path $env:CommonProgramFiles 'Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.dll'
    $dll15 = Join-Path $env:CommonProgramFiles 'Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.dll'

    if (Test-Path $dll16) {
        $vi  = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dll16)
        $ver = [version]"$($vi.ProductMajorPart).$($vi.ProductMinorPart).$($vi.ProductBuildPart).$($vi.ProductPrivatePart)"
    } elseif (Test-Path $dll15) {
        Write-Output 'VULNERABLE - SharePoint 2013 detected (end-of-life; no patch available for CVE-2026-65660).'
        exit 1
    } else {
        Write-Output 'UNKNOWN - SharePoint Server not detected on this host.'
        exit 2
    }

    Write-Output "Detected SharePoint build: $ver"

    # Determine product line by build range and set fixed version
    if ($ver.Build -ge 19000) {
        $product = 'Subscription Edition'
        $fixed   = [version]'16.0.19725.20522'
    } elseif ($ver.Build -ge 10000) {
        $product = 'SharePoint 2019'
        $fixed   = [version]'16.0.10417.20198'
    } elseif ($ver.Build -ge 4300) {
        $product = 'SharePoint 2016'
        $fixed   = [version]'16.0.5565.1001'
    } else {
        Write-Output "UNKNOWN - Unrecognized SharePoint build range: $ver"
        exit 2
    }

    Write-Output "Product: $product | Patched at: $fixed"

    if ($ver -ge $fixed) {
        Write-Output "PATCHED - $product build $ver is at or above $fixed. CVE-2026-65660 is remediated."
        exit 0
    } else {
        Write-Output "VULNERABLE - $product build $ver is below $fixed. Apply August 2026 security update immediately."
        exit 1
    }
} catch {
    Write-Output "UNKNOWN - Error: $($_.Exception.Message)"
    exit 2
}