---
schema: 1
kind: vulnerability
title: "CVE-2026-65660 — Microsoft SharePoint: a SafeControls parser-desync lets an authenticated attacker forge a second Register directive and reach RCE via in-memory XAML deserialization, now confirmed exploited (CVSS 8.8)"
headline: "Microsoft confirms active exploitation of a SharePoint bug it quietly re-rated a month earlier"
summary: >
  CISA added CVE-2026-65660 (Microsoft SharePoint, CVSS 8.8) to its Known
  Exploited Vulnerabilities catalog on 2026-09-25 after Microsoft revised its
  own advisory to confirm observed in-the-wild exploitation, reversing its
  original publication-time exploitability assessment of "Exploitation Less
  Likely." An authenticated, low-privilege attacker can smuggle a forged
  web-part Register directive past SharePoint's SafeControls allow-list to
  achieve in-memory remote code execution; fixed since the 11 August 2026
  cumulative update.
discovered_at: "2026-09-26T04:04:42Z"
updated_at: null
event_date: "2026-09-25"
run_id: 2026-09-26T0404Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, actively-exploited, cisa-kev, poc-public]
regions: [global, europe, switzerland]
sectors: [public-sector]
entities: ["product:microsoft-sharepoint"]
techniques: [T1190, T1505.003]
affected_products: ["Microsoft SharePoint Enterprise Server 2016", "Microsoft SharePoint Server 2019", "Microsoft SharePoint Server Subscription Edition"]
cves:
  - id: CVE-2026-65660
    cvss: "8.8"
    epss: null
    type: deserialization
    vector: zero-click
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "SharePoint Enterprise Server 2016 < 16.0.5565.1001; SharePoint Server 2019 < 16.0.10417.20198; SharePoint Server Subscription Edition < 16.0.19725.20522; the discloser also states the underlying bug affects SharePoint 2013, a version not addressed in Microsoft's CVE record"
    fixed: "16.0.5565.1001 (2016) / 16.0.10417.20198 (2019) / 16.0.19725.20522 (Subscription Edition), shipped in the 11 August 2026 cumulative update"
sources:
  - url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660"
    publisher: "Microsoft Security Response Center"
    date: "2026-09-25"
    role: primary
  - url: "https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog"
    publisher: "CISA"
    date: "2026-09-25"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities Catalog"
    date: "2026-09-25"
    role: corroborating
  - url: "https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660"
    publisher: "Canadian Centre for Cyber Security"
    date: "2026-09-24"
    role: corroborating
  - url: "https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/"
    publisher: "Viettel Cyber Security (Dinh Ho Anh Khoa)"
    date: "2026-09-22"
    role: primary
closed_sources: []
evidence:
  - quote: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability."
    publisher: "Microsoft Security Response Center"
    source_url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660"
  - quote: "Chained with other SharePoint vulnerabilities, this vulnerability can achieve pre-authentication remote code execution on SharePoint servers configured to permit anonymous access."
    publisher: "Canadian Centre for Cyber Security, AL26-023"
    source_url: "https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660"
  - quote: "An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required."
    publisher: "Microsoft Security Response Center FAQ"
    source_url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660"
verification: multi-source
sourcing_note: null
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Patch every Microsoft SharePoint Enterprise Server 2016, Server 2019 and Subscription Edition instance to the 11 August 2026 cumulative update (or later) now, and confirm the separate 9 June 2026 ToolPane-authentication-bypass patch is also applied — its absence is what turns this bug into a pre-authentication chain on servers configured for anonymous access."
updates: []
migrated_from: null
---

CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 2026-09-25 ([CISA, 2026-09-25](https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)), and its KEV catalog data feed carries the field `forensicTriage: Yes` for this CVE — CISA's own designation for entries where its Forensics Triage Requirements guidance applies before remediation ([CISA Known Exploited Vulnerabilities Catalog, JSON feed, 2026-09-25](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). The same day, Microsoft revised its own CVE record to state plainly: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability" ([Microsoft Security Response Center, 2026-09-25](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660)) — a reversal of the exploitability assessment Microsoft's own advisory carried "at the time of original publication," "Exploitation Less Likely" ([Microsoft Security Response Center, 2026-09-25](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660)). Microsoft's own revision log separately records a 27 August 2026 update to the record's Impact, CVE Title and FAQs, described only as "an informational change," with no prior value stated. The bug sits in SharePoint's `ToolPane.GetPartPreviewAndPropertiesFromMarkup()`, which checks a web part's Register directive against the SafeControls allow-list before parsing it; because `RegisterDirective.GetHtml()` writes attribute values inside double quotes without escaping embedded quote characters, an attacker can split a directive's `Src` attribute across the quote boundary to smuggle a second, unchecked Register directive into the markup after the SafeControls check has already run, registering an arbitrary .NET class ([Viettel Cyber Security, Dinh Ho Anh Khoa, 2026-09-22](https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/)). Wrapping `System.Xaml.XamlServices` in an `ExpandedWrapper` and invoking `XamlServices.Parse()` on an `ObjectDataProvider` gadget then yields what the researcher terms an "in-memory webshell" — repeatable code execution held entirely in the worker process's memory, with no file written to disk ([Viettel Cyber Security, 2026-09-22](https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/)). The base bug needs only low-privilege authentication and no user interaction ([MSRC FAQ, 2026-09-25](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660)), and Viettel's public write-up includes the working exploit markup itself; the same researcher separately showed ToolPane's own authentication check can be bypassed via a distinct, already-patched (9 June 2026) flaw, and Canada's Cyber Centre confirms the pair chains to pre-authentication RCE on SharePoint servers configured for anonymous access ([Canadian Centre for Cyber Security, AL26-023, 2026-09-24](https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660)). Fixed since the 11 August 2026 cumulative update, which also disables the vulnerable function by default; the discloser separately states the underlying bug affects SharePoint 2013 as well, a version Microsoft's own CVE record does not address. Canada's Cyber Centre separately flags that SharePoint Enterprise Server 2016 and Server 2019 themselves reached end of life on 15 July 2026 and urges migration to a supported version ([Canadian Centre for Cyber Security, AL26-023, 2026-09-24](https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660)).

Because no file-based web shell is dropped, file-integrity monitoring of the `wwwroot` tree will not catch this technique. Canada's Cyber Centre recommends monitoring for unusual SharePoint administrative activity or suspicious authenticated access attempts, watching for Microsoft Defender or AMSI detections tied to SharePoint exploitation activity, and conducting ongoing log and security monitoring of SharePoint, IIS, endpoint security and authentication logs ([Canadian Centre for Cyber Security, AL26-023, 2026-09-24](https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660)).

**Defender takeaway:** re-triage this CVE if your inventory still carries it as originally published, "Exploitation Less Likely" — the exploitation status changed on 2026-09-25 without most trackers relabeling it. Enable AMSI integration for SharePoint web applications with Request Body Scan Mode set to Full, and restrict or eliminate direct internet exposure of Central Administration and other management interfaces.

**Triage:** ordinary SharePoint web-part usage never registers a second, unchecked control after the SafeControls check has already passed on the same request — a Register directive whose `Src` attribute value contains an embedded, unescaped quote character is itself the anomaly, distinct from routine web-part edits which SharePoint's own markup generation never produces.