An August SharePoint Server patch closed something worse than Microsoft’s advisory admits, a technical write-up published this week shows.
The bulletin and NVD disagree on what CVE-2026-65660 even is. The advisory’s own label is spoofing, its score 6.5, and it records no impact on integrity or availability, while the National Vulnerability Database gives the same flaw 8.8. Microsoft’s own CVE record, revised on September 11, calls it remote code execution. Code injection, CWE-94, is common ground. SharePoint Server 2016, 2019 and Subscription Edition are affected, and the fix arrived with the August 11 updates.
Where the escaping stopped
Viettel Cyber Security’s Dinh Ho Anh Khoa put the write-up together, and his analysis stops at the SafeControls list, the filter SharePoint consults before a server-side control loads.
The escaping step is where it comes apart. Quotes sitting inside the attribute values of a Register directive are written straight through, unescaped, when SharePoint’s ToolPane component rebuilds that directive out of web-part markup. Anyone who inserts a quote of their own gets extra directives appended, and arbitrary .NET classes end up registered in the sliver between the type check passing and the control loading.
Deserialization comes next through XamlServices.Parse, and Khoa built an in-memory web shell that sidesteps the registry permission failures earlier methods hit. Microsoft had already patched the authentication bypass he pairs with the flaw, yet the combination still counts: on servers that allow anonymous page access, the two together deliver code execution before anyone logs in.
How urgent is it
CISA’s Known Exploited Vulnerabilities catalog does not carry it, no attacks in the wild have been reported, and Microsoft rates the odds of exploitation as low even now that the full markup is public. SharePoint 2013 is affected too, though that release has taken no security updates since April 2023.
