🛡️ Security

SafeControls

A SharePoint allowlist that specifies which server-side controls a page is permitted to load, meant to stop arbitrary .NET types from being instantiated through web-part markup. Bypassing it, as CVE-2026-65660 does, lets an attacker load a control the platform never validated.

📚 Deep Dive

Learn Article

How .NET Deserialization Turns Attacker Data Into Code Execution

Deserialization is safe until the format can name types and call methods. A walk through how attacker-controlled bytes become a gadget chain and then running code, and how to design so they cannot.

intermediate 5 min read

Back to Glossary