CVE-2026-65660: SharePoint RCE Disguised as Spoofing Flaw Exposes Triage Failures

As reported by The Hacker News, a SharePoint Server vulnerability Microsoft initially downgraded as a spoofing flaw (CVSS 6.5) has been revealed as an authenticated remote code execution bug with an NVD score of 8.8. The disclosure by Viettel Cyber Security researcher Dinh Ho Anh Khoa exposes not only a serious technical issue but a systemic problem in how vulnerability metadata is communicated to defenders.

The Real Impact: Why the Label Matters

Microsoft's advisory for CVE-2026-65660 assigned no integrity or availability impact, describing it purely as spoofing. Yet the NVD entry—updated September 11—titles the same CVE as a remote code execution vulnerability, and both records cite CWE-94 (code injection). This disconnect is not academic. Organizations that triaged this based on the lower CVSS score and spoofing label likely deprioritized patching during their August cycle. Any environment running unpatched SharePoint Server 2016, 2019, or Subscription Edition now carries a known RCE vector with full technical proof-of-concept details publicly available.

Vulnerability Details

Technical Significance

The root cause is elegant but dangerous: SharePoint's SafeControls mechanism—the gatekeeper intended to block dangerous .NET class loading—can be bypassed through an unescaped quote injection in the ToolPane component's Register directive reconstruction. The type check runs before the control loads, but the attacker's injected directives register arbitrary classes after the check completes. XamlServices.Parse() then deserializes the payload into executable code, and Khoa's writeup includes a working in-memory webshell that sidesteps the registry permission failures typical of other deserialization approaches.

The chaining potential elevates concern further. Khoa demonstrated that CVE-2026-65660 can be combined with a separate authentication bypass—patched June 9—to achieve pre-authentication RCE on SharePoint servers configured to allow anonymous page access. While patched servers are not exposed to the pre-auth path, organizations that applied the August patch but missed the June fix remain vulnerable to the full chain.

Context: SharePoint as a High-Value Target

This is not an isolated incident. Khoa's earlier ToolShell exploit chain, demonstrated at Pwn2Own Berlin in May 2025, was subsequently weaponized by Chinese state-sponsored threat actors and forced emergency Microsoft patches. Another disclosed flaw, CVE-2026-55040, saw exploitation in the wild shortly after details became public in August. The pattern is clear: SharePoint Server is a high-value target for both espionage-motivated APT groups and financially motivated threat actors, and publicly disclosed technical details accelerate weaponization dramatically.

Who Is at Risk

Shield53 Recommendations

Immediate Actions

1. Patch now. Apply the August 2026 SharePoint security updates to all affected servers (2016, 2019, Subscription Edition). This is non-negotiable regardless of prior triage decisions.
2. Verify June 2026 patch status. Confirm that the June 9 authentication bypass fix was applied. If not, apply it immediately to close the pre-auth RCE chain.
3. Disable anonymous page access on any SharePoint site where it is not explicitly required as a compensating control until patching is verified.
4. Hunt for indicators. Search IIS logs and SharePoint ULS logs for anomalous web-part markup submissions, unexpected Register directive patterns, or references to XamlServices or System.Xaml in request payloads. Look for unusual process spawns from the SharePoint application pool identity (typically w3wp.exe).
5. Audit SafeControls configuration and review custom web parts or third-party solutions that may interact with the ToolPane processing pipeline.

Strategic Actions

• Re-examine your CVE triage process. Cross-reference NVD entries against vendor advisories when they diverge. When CWE-94 or similar code-injection classifications appear, treat as RCE-equivalent until confirmed otherwise.
• Treat all SharePoint Server vulnerabilities as high-priority given the demonstrated and repeated exploitation interest from state-aligned actors.
• Segment SharePoint infrastructure. Ensure SharePoint application pool accounts operate with least privilege and are monitored for unexpected child process creation, PowerShell execution, or outbound network connections.
• Deploy EDR with .NET deserialization detection. Modern EDR solutions can detect XamlServices.Parse() abuse patterns and unusual assembly loading sequences.

The gap between Microsoft's initial advisory and the NVD reclassification represents a meaningful risk to the defensive community. When severity metadata is inconsistent, organizations that build automated patch prioritization pipelines around vendor-supplied CVSS scores will systematically under-respond. This case should prompt every security team to evaluate whether their vulnerability management process accounts for advisory-versus-CVE-record divergence—and to build cross-referencing into their triage logic before the next inevitable mismatch.