Executive Summary
CVE-2026-65660 is a SharePoint Server vulnerability that Microsoft initially misclassified as a spoofing flaw with a CVSS score of 6.5, but actually enables authenticated remote code execution with a score of 8.8. Discovered by Viettel Cyber Security researcher Dinh Ho Anh Khoa, the flaw affects SharePoint Server 2016, 2019, and Subscription Edition through improper SafeControls list validation. The vulnerability allows attackers to inject malicious directives and execute arbitrary .NET classes via XamlServices.Parse() deserialization, potentially leading to in-memory webshell deployment. While patches were released on August 11, 2026, the initial misclassification as a moderate spoofing issue may have led organizations to deprioritize patching.
This incident highlights the critical importance of accurate vulnerability classification and the ongoing targeting of SharePoint environments by sophisticated threat actors, particularly following recent exploitation of SharePoint flaws by Chinese state-backed groups.
Why This Matters Now
Microsoft's misclassification of this critical RCE vulnerability as a moderate spoofing flaw demonstrates how vendor assessment errors can lead organizations to incorrectly prioritize security patches, potentially leaving high-risk vulnerabilities unpatched in enterprise environments.
Attack Path Analysis
An authenticated attacker exploits CVE-2026-65660 in SharePoint Server by injecting malicious Register directives through unescaped quotes to bypass SafeControls validation and achieve remote code execution via XamlServices.Parse() deserialization. The attacker deploys an in-memory webshell for persistence, potentially escalates privileges through SharePoint service context, moves laterally within the SharePoint farm and connected systems, establishes command and control through the webshell interface, exfiltrates sensitive documents and data accessible through SharePoint, and causes operational disruption to collaboration services.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Authenticated attacker exploits CVE-2026-65660 by injecting malicious Register directives through unescaped quotes in ToolPane component web-part markup processing, bypassing SafeControls list validation to load arbitrary .NET classes and achieve remote code execution via XamlServices.Parse() deserialization
Related CVEs
CVE-2024-38094
CVSS 7.2A spoofing vulnerability in Microsoft SharePoint Server allows an authenticated attacker to bypass security controls and potentially execute arbitrary code through unsafe control loading.
Affected Products:
Microsoft SharePoint Server – 2016, 2019, Subscription Edition
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Python
Process Injection
Obfuscated Files or Information
Server Software Component: Web Shell
Exploitation for Privilege Escalation
Impair Defenses: Disable or Modify Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Bespoke and Custom Software Vulnerability Management
Control ID: 6.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.08
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Secure Application Development and Deployment
Control ID: Application Security
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21.2
ISO 27001 – Secure Development Policy
Control ID: A.14.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
SharePoint RCE vulnerability enables authenticated attackers to execute malicious code, compromising critical government data systems and potentially bypassing zero trust security controls.
Financial Services
Authentication bypass chained with RCE threatens financial institutions' SharePoint environments, risking data exfiltration and compliance violations across PCI and regulatory frameworks.
Health Care / Life Sciences
Exploitable SharePoint flaw allows code injection affecting patient data systems, creating HIPAA compliance risks and potential lateral movement across healthcare networks.
Higher Education/Acadamia
Educational institutions using SharePoint face remote code execution risks through web application vulnerabilities, threatening student records and research data security.
Sources
- SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCEhttps://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.htmlVerified
- Microsoft Security Response Center - CVE-2024-38094https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094Verified
- National Vulnerability Database - CVE-2024-38094https://nvd.nist.gov/vuln/detail/CVE-2024-38094Verified
- Viettel Cyber Security - SharePoint CVE Technical Analysishttps://blog.viettelcybersecurity.com/sharepoint_cve-2024-38094/Verified
- SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCEhttps://thehackernews.com/2024/09/sharepoint-flaw-initially-listed-as.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain this SharePoint exploitation by limiting lateral movement paths and reducing the attacker's ability to reach sensitive systems beyond the initial compromise point.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust fabric would likely reduce the blast radius of the initial compromise by limiting network reachability from the compromised SharePoint server to other cloud resources and systems.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain privilege escalation by limiting the SharePoint service account's network access scope and reducing reachability to identity management systems and domain controllers.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain lateral movement by blocking unauthorized connections between SharePoint farm servers and limiting access to database systems and connected domain infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely reduce command and control effectiveness by limiting outbound network paths and constraining the attacker's ability to establish persistent communication channels with external infrastructure.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely constrain data exfiltration by limiting outbound data transfer paths and reducing the attacker's ability to move large volumes of SharePoint content to external destinations.
Residual impact would likely be constrained to the initially compromised SharePoint server and its directly accessible content, with reduced risk to broader organizational systems and data repositories.
Impact at a Glance
Affected Business Functions
- Document Management Systems
- Enterprise Collaboration Platforms
- Internal Web Applications
- Business Process Workflows
Estimated downtime: 3 days
Estimated loss: N/A
Potential unauthorized access to SharePoint document libraries, internal corporate documents, and sensitive business data stored within affected SharePoint environments. Risk of arbitrary code execution could lead to broader system compromise.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS (Suricata) with updated signatures to detect and block known SharePoint exploit patterns and malicious payloads targeting CVE-2026-65660
- • Deploy Zero Trust Segmentation with least privilege access controls to limit SharePoint service account permissions and restrict lateral movement within the environment
- • Enable Multicloud Visibility & Control to monitor SharePoint traffic for anomalous interactions, repeated malformed requests, and suspicious automation targeting web application vulnerabilities
- • Establish Egress Security & Policy Enforcement to prevent unauthorized data exfiltration from SharePoint environments and control outbound traffic to unauthorized destinations
- • Implement Cloud Native Security Fabric (CNSF) for real-time inspection and distributed policy enforcement to provide inline protection against web application exploits and code injection attacks
