FHN 
Microsoft has disclosed a high-severity security flaw in its on-premises SharePoint Server products that could allow an authenticated attacker with low-level access to execute malicious code remotely.
The vulnerability is tracked as CVE-2026-65660 and has a CVSS score of 8.8. It affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
Since SharePoint environments can contain sensitive company documents and operate with powerful service accounts, a successful attack could potentially lead to credential theft, data theft, movement across the network, or continued access.
A Problem With SharePoint Security Checks
The vulnerability was discovered by Dinh Ho Anh Khoa from Viettel Cyber Security.
The issue involves SharePoint’s SafeControls protection, which is designed to prevent potentially unsafe server-side classes from being loaded while processing Web Part and page content.
The problem occurs when the ToolPane component handles specially crafted Register directives. An attacker can manipulate the way certain values are reconstructed, potentially changing the directive after SharePoint has already performed its security validation.
This can allow dangerous .NET classes to be registered and used as part of a code-execution chain.
The research demonstrated an attack chain involving XamlServices.Parse(), ExpandedWrapper, ObjectDataProvider, and LosFormatter.
The technique can also create an in-memory webshell, meaning an attacker may not need to leave a traditional webshell file on the server.
What Organizations Should Do
Microsoft released fixes for the vulnerability on August 11, 2026.
The affected SharePoint builds mentioned in the provided advisory are:
- SharePoint 2016: 16.0.5565.1001
- SharePoint 2019: 16.0.10417.20198
- SharePoint Subscription Edition: 16.0.19725.20522
Microsoft requires organizations to install all applicable update packages. SharePoint 2016 administrators may need to install both listed packages.
The research also points to a possible connection with an authentication weakness in ToolPane. Under certain configurations that allowed anonymous access, the vulnerabilities could potentially be chained to achieve pre-authentication remote code execution. The provided information says Microsoft addressed that anonymous-access route in its June 9, 2026 update.
Security teams should patch affected SharePoint servers, reduce unnecessary anonymous or internet-facing access, and review activity for suspicious Web Part requests.
During an investigation, teams should also examine IIS logs, ULS logs, Windows events, PowerShell activity, endpoint telemetry, unexpected processes, unusual assemblies, and memory activity.
SharePoint 2013 was also reportedly affected by the underlying technique, but that version reached end of support in 2023. Organizations still running it should consider migration or isolation rather than relying on a future security update.
About the Author
