Microsoft has identified a significant security vulnerability in its on-premises SharePoint Server, which allows authenticated users with minimal privileges to execute arbitrary code remotely. This high-severity flaw, identified as CVE-2026-65660, poses a risk to servers running SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, with a CVSS score of 8.8.
Technical Details of the Vulnerability
The vulnerability was brought to light by Viettel Cyber Security’s Dinh Ho Anh Khoa, who highlighted it as a bypass of SharePoint’s SafeControls, a mechanism designed to prevent the instantiation of untrusted server-side classes. The flaw is triggered when the ToolPane component processes Register directives that map tag prefixes to ASP.NET controls.
During processing, ToolPane separates directives from markup and verifies their types. However, the reconstruction of these directives fails to escape embedded quotation marks, allowing malicious values to alter the directive. This error makes it possible for attackers to register dangerous .NET classes and execute arbitrary code.
Impact and Exploitation
Successful exploitation of this flaw could lead to credential theft, lateral movement within networks, and data exfiltration. Although Microsoft states that authentication is necessary for exploitation and that the risk of pre-authentication remote code execution (RCE) was mitigated in a June 2026 update, the public availability of technical details lowers the barrier for potential attacks.
Researchers have demonstrated the potential for creating in-memory webshells, which avoid writing to disk and complicate detection and response efforts. This sophisticated technique underscores the need for organizations to remain vigilant and proactive in their security measures.
Advisory and Mitigation Steps
Microsoft released patches on August 11, 2026, to address the issue, urging organizations to apply updates immediately. Administrators should ensure that all relevant updates are installed, especially for SharePoint 2016, which may require additional packages. Systems still running SharePoint 2013, which is no longer supported, should consider urgent migration or isolation.
To mitigate risk, administrators are advised to limit internet and anonymous access, review low-privilege accounts, and monitor for suspicious activity such as unusual Web Part markup or encoded XAML in POST requests. Furthermore, response teams should examine worker-process behaviors and preserve key logs and telemetry data during investigations.
Despite Microsoft’s assessment that exploitation is unlikely, the public dissemination of detailed information means that organizations must act swiftly to secure their systems against potential threats.
