Improper control of generation of code

CVE-2026-65660 is a code-injection flaw in how Microsoft SharePoint Server's ToolPane component rebuilds ASP.NET Register directives from web-part markup. When writing attribute values, SharePoint wraps them in double quotes without escaping embedded quotes, letting an attacker splice in a second Register directive that references an arbitrary .NET class. Because the SafeControls allowlist check runs against the *first* directive only, the injected class loads unchecked. From there the attacker calls XamlServices.Parse() with an ObjectDataProvider gadget chain to achieve full code execution inside the w3wp.exe worker process. The working exploit — including an in-memory webshell that leaves no disk artifacts — was published by Dinh Ho Anh Khoa of Viettel Cyber Security on September 22, 2026. Affected products are SharePoint Server 2016, 2019, and Subscription Edition; SharePoint 2013 is also vulnerable but end-of-life with no patch. SharePoint Online (Microsoft 365) is not affected.

Microsoft initially scored this CVE at 6.5 as a spoofing flaw — a dramatic under-call. The NVD scored it 8.8 (HIGH) with full C/I/A impact, and Microsoft silently updated its own CVE record on September 11 to title it a Remote Code Execution vulnerability. The NVD HIGH rating is fair for the *standalone* bug: it requires authentication (PR:L), but in a typical enterprise that means any of thousands of SharePoint users. When you layer in the domain-compromise blast radius (farm service account → AD credential extraction → DC pivot) and the pre-auth chain via CVE-2026-55040 (JWT bypass, patched July 2026), the effective risk for unpatched on-prem farms is at least HIGH and arguably tipping into CRITICAL territory. We hold at HIGH 8.0 because the auth requirement provides real — if thin — friction, and no in-the-wild exploitation has been confirmed yet.

1. Apply August 2026 CU immediately on internet-facing farms — Install KB5002905 (SP2016), KB5002894 (SP2019), or KB5002893 (SPSE) on any SharePoint farm reachable from the internet. For a HIGH verdict, the noisgate mitigation SLA is 30 days, but internet-facing farms with a public PoC should be treated as emergency — deploy within days.
2. Verify July 2026 patch for CVE-2026-55040 is applied — The July 2026 patch (KB5002891 for SP2016) closes the JWT authentication bypass that enables the pre-auth RCE chain. Without it, CVE-2026-65660 becomes unauthenticated. Confirm this is applied before the August CU.
3. Block or restrict ToolPane endpoints at the WAF or reverse proxy — Add WAF rules to block or alert on POST requests to /_layouts/15/AddGallery.aspx and /_layouts/15/ToolPane.aspx containing Register directives in the request body. This breaks the exploit delivery path without affecting normal SharePoint usage for most organizations. Deploy within 30 days per noisgate mitigation SLA for HIGH.
4. Audit and reduce farm service account privileges — The blast radius depends on the farm service account having elevated AD privileges. Remove the account from Domain Admins and Administrators groups. Configure it with minimum required permissions per Microsoft's least-privilege guidance. This limits the Step 6 domain-compromise pivot even if code execution succeeds.
5. Enable EDR monitoring for w3wp.exe anomalies — Configure your EDR to alert on w3wp.exe spawning child processes (cmd.exe, powershell.exe, net.exe, certutil.exe, whoami.exe). Also enable .NET ETW tracing for XamlServices.Parse() calls in the SharePoint application pool. This provides detection coverage for Steps 4-5 of the attack chain.
6. Disable anonymous access on all SharePoint web applications — Removes the precondition for the pre-auth chain via CVE-2026-55040. Review each web application's authentication settings in Central Administration and ensure anonymous access is disabled unless explicitly required and risk-accepted.

Run this script on each SharePoint server in the farm as a local administrator. It checks the SharePoint DLL build version (for Subscription Edition) and installed KBs (for SP2016/SP2019) to determine patch status. Example: .\Check-CVE-2026-65660.ps1. Note: SharePoint CU patches may not always appear in Get-HotFix; if the script returns VULNERABLE but you believe the patch is installed, cross-reference the SPSE build threshold (>= 16.0.19725.20522) manually via (Get-SPFarm).BuildVersion.

# CVE-2026-65660 Patch Check - Microsoft SharePoint Server
# Run on each SharePoint server as local administrator.
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
param()
$ErrorActionPreference = 'Stop'
try {
    $dll = $null
    foreach ($v in '16.0','15.0') {
        $rk = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\$v"
        if (Test-Path $rk) {
            $loc = (Get-ItemProperty $rk -EA SilentlyContinue).Location
            if ($loc) {
                $candidate = Join-Path $loc 'ISAPI\Microsoft.SharePoint.dll'
                if (Test-Path $candidate) { $dll = $candidate; break }
            }
        }
    }
    if (-not $dll) { Write-Host 'UNKNOWN - SharePoint not installed on this host.'; exit 2 }
    $ver = [version](Get-Item $dll).VersionInfo.FileVersion
    Write-Host "SharePoint DLL version: $ver"
    if ($ver.Major -eq 15) {
        Write-Host 'VULNERABLE - SharePoint 2013 is end-of-life. No patch available.'
        exit 1
    }
    if ($ver.Major -ne 16) { Write-Host "UNKNOWN - Unexpected version $ver"; exit 2 }
    # SharePoint Subscription Edition: patched at build 16.0.19725.20522+
    if ($ver -ge [version]'16.0.19725.20522') {
        Write-Host 'PATCHED - SharePoint SE build meets August 2026 CU threshold.'
        exit 0
    }
    # For SP2016 and SP2019, check for the specific August 2026 KB
    $edition = if ($ver.Build -lt 10000) { 'SP2016' } else { 'SP2019' }
    $targetKB = if ($edition -eq 'SP2016') { '5002905' } else { '5002894' }
    Write-Host "Edition: $edition - checking for KB$targetKB"
    $found = Get-HotFix -EA SilentlyContinue | Where-Object { $_.HotFixID -match $targetKB }
    if ($found) {
        Write-Host "PATCHED - KB$targetKB is installed."
        exit 0
    }
    Write-Host "VULNERABLE - KB$targetKB not found. Apply the August 2026 security update."
    exit 1
} catch {
    Write-Host "UNKNOWN - Error: $_"
    exit 2
}

1. The Hacker News — SharePoint Flaw Initially Listed as Spoofing Enables Authenticated RCE
2. The CyberSec Guru — CVE-2026-65660: Microsoft SharePoint RCE Exploit Explained
3. MSRC — CVE-2026-65660 Security Update Guide
4. Resecurity — From Web Request to Domain Compromise: July 2026 SharePoint Attacks
5. Stefan Goßner — SharePoint Security Fixes in August 2026 PU
6. CISA — SharePoint Hardening Advisory (July 2026)
7. Strix.ai — CVE-2026-65660 SharePoint Server Code Injection
8. Rapid7 — CVE-2026-55040 SharePoint JWT Authentication Bypass