SharePoint CVE-2026-65660: The 'Spoofing' Bug That Was Really RCE, Now Exploited

On 25 September 2026 CISA added CVE-2026-65660, a Microsoft SharePoint Server flaw, to its Known Exploited Vulnerabilities catalog and gave federal agencies until 28 September to remediate. The short deadline is not the only reason to move. This is a bug Microsoft first shipped as a moderate "spoofing" issue, quietly reclassified as remote code execution six weeks later, and that a security vendor watched being exploited a day before it hit the KEV list. If your triage process filed it under "spoofing" back in August, it is time to reopen the ticket.

What Happened

Microsoft patched CVE-2026-65660 on 11 August 2026 as part of that month's Patch TuesdayPatch Tuesday🛡️The second Tuesday of each month, when Microsoft releases its scheduled batch of security updates. The predictable cadence lets defenders plan deployment, but AI-assisted vulnerability discovery has pushed recent releases past 900 CVEs, straining triage.. The original advisory described an authorized attacker performing spoofing and carried a CVSS 3.1 base score of 6.5, the kind of rating that lands a fix in the "next maintenance window" pile. On 27 August Microsoft revised the record, changing the title, the impact, and the FAQ text. The vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. was now remote code execution with a base score of 8.8. Microsoft labeled the revision "informational," but for defenders it was a category change: from a bug that lets an attacker impersonate content to one that lets an attacker run code on the server.

The reclassification lined up with public research. Dinh Ho Anh Khoa of Viettel Cyber Security, the researcher who demonstrated the original ToolShell chain against SharePoint at Pwn2Own Berlin in May 2025, published a technical write-up describing exactly how the bug reaches code execution. Days later, the threat-intelligence firm Previdian reported catching exploitation attempts against a SharePoint honeypotHoneypot🛡️A decoy system deployed to be attacked so defenders can observe exploitation attempts safely. Honeypot networks give early warning that a vulnerability has moved from theoretical to actively exploited, often before official catalogs like CISA KEV confirm it.. Microsoft's own advisory now carries a 25 September revision noting "reliable evidence of observed attacks," and CISA added the CVE to the KEV catalog the same day with a forensic-triage requirement under Binding Operational Directive 26-04.

Who Is Affected

The flaw affects on-premises SharePoint Server only: Enterprise Server 2016, Server 2019, and the Subscription Edition. SharePoint Online and Microsoft 365Microsoft 365🌐Microsoft's subscription-based cloud productivity suite including Office applications, Exchange Online, SharePoint, and Teams. deployments are out of scope. SharePoint Server 2013, which left support in April 2023, is architecturally similar but receives no patch and should be treated as permanently exposed.

The fixed builds are 16.0.5565.1001 for 2016 (KB5002905 / KB5002906), 16.0.10417.20198 for 2019 (KB5002894 / KB5002896), and 16.0.19725.20522 for the Subscription Edition (KB5002893). All three were released on 11 August. Any farm still on a pre-August build carries the vulnerable code. Because SharePoint patch levels can drift across a farm, confirm the build on every server, not just the one you patched last.

How the Bug Works

SharePoint keeps an allowlist called SafeControlsSafeControls🛡️A SharePoint allowlist that specifies which server-side controls a page is permitted to load, meant to stop arbitrary .NET types from being instantiated through web-part markup. Bypassing it, as CVE-2026-65660 does, lets an attacker load a control the platform never validated. that decides which server-side controls a page is permitted to load. It is the guardrail that stops arbitrary .NET types from being instantiated through web-part markup. CVE-2026-65660 is a way around that guardrail.

When the ToolPane component reconstructs Register directives from submitted markup, it wraps attribute values in quotes without escaping any quotes already inside those values. An attacker who plants a quote character in an attribute can close the string early and append directives of their own. The result is that the SafeControls check runs against one version of the markup while a different version is what actually gets parsed and loaded. Registering an arbitrary .NET class is then a short step to code execution: the public research chains it through .NET deserializationDeserialization🛡️The process of converting stored or transmitted data back into an object. Insecure deserialization can allow attackers to execute code by manipulating serialized data. primitives such as XamlServices.Parse, ObjectDataProvider, and LosFormatter to run attacker-controlled code inside the SharePoint worker process. Readers who want the underlying mechanism should see our explainer on how .NET deserialization turns attacker data into code execution. The demonstrated payload runs entirely in memory and drops no file to disk, which is what makes it dangerous to defenders who rely on file scanning.

How Attackers Are Chaining It

On its own, CVE-2026-65660 requires an authenticated, low-privileged account; the ToolPane route calls an authentication check during initialization. That requirement is why the reclassified score is 8.8 rather than a perfect 10. The exploitation Previdian observed removes it.

According to Previdian, around noon UTC on 24 September a single source sent twelve POST requests to a honeypot, targeting AddGallery.aspx and designgallery.aspx with the query string DisplayMode=Edit and no authentication cookie or header. Those pages are WebPartPage types that, before a separate June 2026 fix, could open a ToolPane in edit mode without an authentication check on sites that allow anonymous viewing. Chaining that anonymous-delivery bug with the quote-injection flaw turns an authenticated vulnerability into a pre-authentication one. Viettel's researcher notes he could not identify a CVE for the June issue; some reporting associates the anonymous route with CVE-2026-55040, a separate SharePoint authentication-bypass patched in July. The dependency on an anonymous-viewing configuration is the practical takeaway either way.

The payload arrived in two stages: a small first body carrying a gadget to disable a .NET deserialization type-check, and a much larger second body carrying an encrypted assembly loader. A 25 September update from Previdian reported that successful exploitation creates an in-memory webshellIn-Memory Webshell🛡️A backdoor loaded and executed inside a running process without being written to disk as a file. Because no file exists for scanners to detect, it must be hunted through process behavior, memory analysis, and logs rather than file signatures. backdoor at the path /_layouts/15/sphealth.aspx. Previdian is careful to note these were attempted requests against a honeypot and do not prove the chain succeeds against a hardened production farm, but the intent is unambiguous. Because the payload leaves nothing on disk, hunting for it is a memory-and-log exercise; our guide on how to hunt for in-memory webshells that leave no file on disk covers the approach.

Immediate Actions

Confirm every on-premises SharePoint server is on the August 2026 build or later, and apply all update packages Microsoft lists for your edition rather than assuming one KB covers the farm. Review which sites permit anonymous viewing and disable it where it is not required, since that setting is the precondition for the pre-authentication path. Treat any internet-facing SharePoint that was unpatched between 11 August and now as potentially compromised, and begin triage on it. Look for POST requests to AddGallery.aspx or designgallery.aspx carrying DisplayMode=Edit with no authentication material, and for the sphealth.aspx path. The known source address in Previdian's capture was 169.150.248.21, useful for retrospective correlation within that window but not a durable indicator on its own.

Long-Term Outlook

The story of CVE-2026-65660 is less about one SharePoint bug than about how a severity label shapes response. A 6.5 spoofing rating and an 8.8 code-execution rating produce completely different patch timelines, and the gap between them was the window attackers used. When a vendor revises an advisory upward, that revision needs to trigger a fresh triage, not sit as an "informational" footnote. Our piece on why a severity downgrade in a vendor advisory can leave you exposed looks at how to build that re-triage step into a vulnerability program. On-premises SharePoint remains one of the most reliably targeted enterprise platforms, as this year's steady drumbeat of ToolShell-lineage bugs and the record-size Patch Tuesday releases have shown. The servers that host it deserve the monitoring and network isolation of a tier-zero asset, not the treatment of an internal file share.

Sources

• Microsoft Security Response Center, CVE-2026-65660 (advisory, revision history, CVSS, KBs): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
• NVD, CVE-2026-65660 (CVSS vector, CWE-94, affected version ranges, KEV and SSVC data): https://nvd.nist.gov/vuln/detail/CVE-2026-65660
• CISA Known Exploited Vulnerabilities Catalog (dateAdded 2026-09-25, due 2026-09-28): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Previdian, "CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts" (Ryan Dewhurst, 24-25 Sep 2026): https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
• Viettel Cyber Security, SharePoint CVE-2026-65660 research (Dinh Ho Anh Khoa): https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/
• The Hacker News, "SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE" (22 Sep 2026): https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html