Microsoft SharePoint SafeControls parser-desync to in-memory RCE via XamlServices deserialization, confirmed exploited (CVSS 8.8)

CVE-2026-65660, Microsoft SharePoint: a SafeControls parser-desync lets an authenticated attacker forge a second Register directive and reach RCE via in-memory XAML deserialization, now confirmed exploited (CVSS 8.8)

CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 2026-09-25 (CISA, 2026-09-25), and its KEV catalog data feed carries the field forensicTriage: Yes for this CVE; CISA's own designation for entries where its Forensics Triage Requirements guidance applies before remediation (CISA Known Exploited Vulnerabilities Catalog, JSON feed, 2026-09-25). The same day, Microsoft revised its own CVE record to state plainly: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability" (Microsoft Security Response Center, 2026-09-25), a reversal of the exploitability assessment Microsoft's own advisory carried "at the time of original publication," "Exploitation Less Likely" (Microsoft Security Response Center, 2026-09-25). Microsoft's own revision log separately records a 27 August 2026 update to the record's Impact, CVE Title and FAQs, described only as "an informational change," with no prior value stated. The bug sits in SharePoint's ToolPane.GetPartPreviewAndPropertiesFromMarkup(), which checks a web part's Register directive against the SafeControls allow-list before parsing it; because RegisterDirective.GetHtml() writes attribute values inside double quotes without escaping embedded quote characters, an attacker can split a directive's Src attribute across the quote boundary to smuggle a second, unchecked Register directive into the markup after the SafeControls check has already run, registering an arbitrary .NET class (Viettel Cyber Security, Dinh Ho Anh Khoa, 2026-09-22). Wrapping System.Xaml.XamlServices in an ExpandedWrapper and invoking XamlServices.Parse() on an ObjectDataProvider gadget then yields what the researcher terms an "in-memory webshell", repeatable code execution held entirely in the worker process's memory, with no file written to disk (Viettel Cyber Security, 2026-09-22). The base bug needs only low-privilege authentication and no user interaction (MSRC FAQ, 2026-09-25), and Viettel's public write-up includes the working exploit markup itself; the same researcher separately showed ToolPane's own authentication check can be bypassed via a distinct, already-patched (9 June 2026) flaw, and Canada's Cyber Centre confirms the pair chains to pre-authentication RCE on SharePoint servers configured for anonymous access (Canadian Centre for Cyber Security, AL26-023, 2026-09-24). Fixed since the 11 August 2026 cumulative update, which also disables the vulnerable function by default; the discloser separately states the underlying bug affects SharePoint 2013 as well, a version Microsoft's own CVE record does not address. Canada's Cyber Centre separately flags that SharePoint Enterprise Server 2016 and Server 2019 themselves reached end of life on 15 July 2026 and urges migration to a supported version (Canadian Centre for Cyber Security, AL26-023, 2026-09-24).

Because no file-based web shell is dropped, file-integrity monitoring of the wwwroot tree will not catch this technique. Canada's Cyber Centre recommends monitoring for unusual SharePoint administrative activity or suspicious authenticated access attempts, watching for Microsoft Defender or AMSI detections tied to SharePoint exploitation activity, and conducting ongoing log and security monitoring of SharePoint, IIS, endpoint security and authentication logs (Canadian Centre for Cyber Security, AL26-023, 2026-09-24).

Triage: ordinary SharePoint web-part usage never registers a second, unchecked control after the SafeControls check has already passed on the same request, a Register directive whose Src attribute value contains an embedded, unescaped quote character is itself the anomaly, distinct from routine web-part edits which SharePoint's own markup generation never produces.