SharePoint CVE-2026-65660: Code Injection Exploit Active as CISA Deadline Hits Monday

The flaw originates in how SharePoint Server's ToolPane component reconstructs XML Register directives when processing web-part page markup. ToolPane writes the value of each directive attribute between double-quote characters in its output without applying any escaping to double-quote characters that appear inside the value itself.

An attacker exploiting CVE-2026-65660 sends a POST request to the /_layouts/15/ToolPane.aspx endpoint with a crafted web-part body. The body contains a Register directive whose Namespace or Assembly attribute value includes an embedded double-quote character followed by a second Register directive that references an arbitrary .NET assembly and type. When ToolPane reconstructs the markup and evaluates it, the injected second directive is processed after the SafeControls allowlist check has already passed for the first directive. The target type is loaded outside the SafeControls filter.

Once the attacker controls which .NET type is instantiated, the exploit calls XamlServices.Parse() to complete code execution through the .NET deserialization pipeline. Researchers demonstrated a working in-memory webshell payload that avoids the Windows Registry permission failures that other deserialization paths encounter. The entire exploit chain runs within the IIS worker process (w3wp.exe) under the SharePoint application pool identity, which typically holds network service or a managed service account with read/write access to SharePoint content databases.

Microsoft originally shipped this CVE on August 11 as a spoofing vulnerability at CVSS 6.5. On September 11, Microsoft silently updated the CVE record title to reflect that the flaw enables remote code execution. The National Vulnerability Database scores it 8.8. The reclassification means many organizations that correctly deprioritized a "spoofing" flaw still have not applied the patch.

Previous posts on Microsoft Exchange pre-auth RCE chains document how attackers use on-premises Microsoft collaboration infrastructure as a staging point for lateral movement once initial server access is achieved.

CVE-2026-65660 affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, all of which have vendor-supplied patches in the August 11, 2026 security update. Microsoft also confirmed that SharePoint Server 2013 is vulnerable. SharePoint 2013 reached end of support in April 2023 and will never receive a patch. Any organization still running 2013 on an internet-accessible network has a permanent, unpatchable attack surface.

For organizations running supported versions, the exposure gap is between the August 11 patch release date and the moment the update is applied. Because Microsoft initially labeled this as a spoofing vulnerability at CVSS 6.5 when it shipped the fix, security teams using severity-based patch prioritization commonly would have ranked it below critical remote code execution flaws. Organizations that did not re-assess after Microsoft's September 11 silent reclassification are still operating on that incorrect risk score.

The authenticated attack baseline requires any valid SharePoint user account, not administrator privileges. In enterprise environments where SharePoint is accessible to all employees or to federated external partners, the attacker pool includes any compromised user credential, any phished session token, or any valid account obtained from an initial access broker.

Deployments that skipped the June 9, 2026 security update face an additional exposure: the ToolPane authentication weakness that researchers chained with CVE-2026-65660 for pre-authentication RCE was patched in that June release. Organizations without that fix can be attacked without a valid SharePoint account. Confirm both the June 9 and August 11 builds are applied.

Previdian confirmed attack attempts chaining CVE-2026-65660 with an anonymous delivery mechanism for the crafted web-part markup. In the observed attacks, the threat actors delivered an encrypted loader to the compromised SharePoint server, then established server control through an in-memory webshell that communicated outbound to command-and-control infrastructure using encrypted channels.

The authenticated version of the attack (the only variant affecting fully patched June 2026 builds) requires a valid session cookie or NTLM authentication token. In active attacks, researchers observed attackers obtaining these credentials through credential stuffing against Microsoft 365 federation points, then replaying stolen tokens to authenticate to on-premises SharePoint before triggering the injection chain.

The attack chain has direct parallels to the BigBear AiTM phishing campaign against Microsoft 365 MFA documented in September 2026, where adversary-in-the-middle proxies captured session tokens that were later reused to authenticate to on-premises SharePoint through federated trust relationships. Organizations that have deployed Azure Entra ID with hybrid authentication must ensure their on-premises SharePoint builds match their cloud security posture.

Microsoft stated on September 25 that it has reliable evidence of observed attacks against CVE-2026-65660 exploitation. CISA added it to KEV on September 24 with a September 28 remediation deadline. The combination of confirmed active exploitation, a Monday federal deadline, and a broadly deployed attack surface makes this a weekend patching priority for every organization running SharePoint Server.

No specific attacker-controlled IP addresses or C2 domains have been publicly confirmed for CVE-2026-65660 exploitation campaigns at the time of writing. Detection must rely on behavioral and structural indicators derived from the attack mechanism. Review the following artifacts in IIS logs, SharePoint Unified Logging Service (ULS) logs, and endpoint telemetry.

Search IIS access logs for POST requests to /_layouts/15/ToolPane.aspx with request body sizes above 4 KB, which are anomalous for normal ToolPane usage. Review SharePoint ULS logs for entries referencing XamlServices, unexpected assembly load events, or .NET type registration failures that precede a successful webshell request. Monitor IIS worker processes (w3wp.exe) for any child process creation involving cmd.exe, powershell.exe, certutil.exe, mshta.exe, or wscript.exe, which are consistent with post-exploitation webshell command execution. Watch for unexpected file creation events under SharePoint virtual directories, particularly .aspx and .ashx files not associated with recent deployments.

Network-level: alert on unexpected outbound HTTP or HTTPS connections from the SharePoint server to destinations outside your organization's known IP ranges, particularly connections established by the w3wp.exe process rather than SharePoint's scheduled service processes.

Two detection rules cover the primary attack phases for CVE-2026-65660: the initial exploitation attempt via the SharePoint ToolPane endpoint and the post-exploitation signature of the IIS worker process spawning unexpected child processes. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

Apply the August 11, 2026 security update as the primary remediation. The following steps cover immediate patching, verification, and compensating controls for deployments where emergency patching is not possible this weekend.

The combination of three factors makes CVE-2026-65660 an immediate priority this Saturday. First, Microsoft's mislabeling of the flaw as spoofing at CVSS 6.5 when it patched it on August 11 created a 45-day window during which organizations applying severity-based patch schedules correctly deprioritized it. Security teams that patched critical and high RCE flaws first made a rational decision based on Microsoft's own classification. The reclassification on September 11 and CISA KEV listing on September 24 change that calculus entirely.

Second, the pre-authentication attack path remains open for any organization that applied the August 11 patch without the June 9 update. Both updates are required to close all known exploitation vectors. A single-step patch review that confirms only the August build number will miss this exposure.

Third, SharePoint Server's position in enterprise architecture gives attackers significant post-exploitation leverage. A compromised SharePoint application pool identity typically has read access to SharePoint content databases, write access to SharePoint file shares, and trust relationships with Active Directory that enable lateral movement. Attackers who obtain code execution on the SharePoint server are not constrained to exfiltrating SharePoint content. They can use the server's network position and service account privileges as a staging point for broader network compromise.

The Monday September 28 federal deadline reflects CISA's assessment that exploitation is underway at scale. Private sector organizations are not bound by BOD 26-04 remediation timelines, but the threat intelligence behind that deadline applies equally to any organization running an internet-accessible SharePoint server.