SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

A Dangerous Disconnect Between Advisory and CVE Record

A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published by Viettel Cyber Security researcher Dinh Ho Anh Khoa — the same researcher behind the original ToolShell exploit chain demonstrated at Pwn2Own Berlin in May 2025.

Tracked as CVE-2026-65660, the flaw carries an NVD CVSS score of 8.8 and was patched by Microsoft on August 11, 2026. But the gap between Microsoft's own advisory language and the CVE database's classification left defenders triaging the bug as a lower-priority spoofing issue for weeks.

Vulnerability Summary

How the Flaw Was Misclassified

Microsoft's advisory describes CVE-2026-65660 as allowing "an authorized attacker to perform spoofing," while the underlying CVE record separately and correctly notes it enables "an authorized attacker to execute code." That contradiction meant security teams relying solely on Microsoft's advisory text — rather than the full CVE record and third-party analysis — may have deprioritized patching.

What's Actually Exploitable

The vulnerability stems from improper quote escaping in SharePoint's SafeControls validation. When the ToolPane component processes web-part markup, it reconstructs Register directives without properly escaping embedded quotes. This lets an authenticated attacker inject arbitrary .NET class directives that bypass SharePoint's security filters.

From there, attackers can register malicious classes after type-checking but before control loading, then use XamlServices.Parse() deserialization to achieve code execution — deploying an in-memory web shell with no file dropped to disk.

Exploitation Status

No wild exploitation has been confirmed, and the flaw does not currently appear in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the full exploit markup is now public, and the researcher has already used it in penetration testing engagements — raising the likelihood of weaponization.

Organizations that applied Microsoft's June 9, 2026 patch for a related pre-authentication bypass are already protected against chaining this flaw into a pre-auth RCE path.

Recommendations

• Apply the August 11, 2026 SharePoint patch if not already deployed — it disables the vulnerable function by default
• Confirm the June 9, 2026 authentication-bypass patch is also applied to close the pre-auth chaining path
• Re-triage this CVE as high-severity RCE, not spoofing, in any prior risk assessments
• Review SharePoint access logs for anomalous ToolPane or web-part registration activity

Sources

• The Hacker News — SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE