Microsoft’s SharePoint Server has a vulnerability, CVE-2026-65660, initially rated as a spoofing flaw, which can lead to authenticated remote code execution (RCE). This revelation was made by Dinh Ho Anh Khoa, a researcher from Viettel Cyber Security. The flaw impacts SharePoint Server 2016, 2019, and Subscription Edition, with patches available since August 11.
Understanding the Vulnerability
Despite being labeled initially as a spoofing issue with a CVSS score of 6.5, the flaw is now recognized for its potential to enable RCE, with a revised score of 8.8. Microsoft’s advisory initially did not highlight the code execution risk, but the National Vulnerability Database provides a more accurate assessment.
The vulnerability allows authorized attackers to inject arbitrary .NET classes, exploiting SharePoint’s failure to verify server-side controls adequately. The flaw is linked to CWE-94, a code injection weakness, making it a critical concern for cybersecurity professionals.
Exploitation and Mitigation
Dinh Ho Anh Khoa demonstrated the vulnerability during Pwn2Own Berlin in 2025, where it was exploited by state-backed groups, prompting emergency patches from Microsoft. Although the flaw has not been reported in active exploitation, the public availability of the exploit markup raises concerns.
Microsoft’s August update addresses the flaw by disabling the vulnerable function. Additionally, a previous authentication bypass was patched in June, mitigating pre-authentication RCE on servers with anonymous access enabled.
Historical Context and Future Implications
Past exploits, like the ToolShell chain, highlight the ongoing risks associated with SharePoint vulnerabilities. Khoa has previously disclosed flaws such as CVE-2026-55040, which was rapidly exploited post-disclosure. SharePoint 2013, although out of support, is also affected, further complicating security for users of older versions.
The cybersecurity community must stay vigilant, applying available patches and monitoring for any signs of exploitation. While Microsoft’s advisory suggests a low likelihood of exploitation, organizations should not underestimate the potential impact of these vulnerabilities. Ongoing vigilance and timely updates are crucial for protecting sensitive data and maintaining secure environments.
For future-proofing, organizations should consider upgrading to supported versions and implementing robust security measures to prevent unauthorized access and code execution.
