CVE-2026-65660: a validation-order flaw in SharePoint SafeControls
What the advisory describes
Microsoft published CVE-2026-65660 for an on-premises SharePoint Server code injection flaw, rated 8.8 under CVSS 3.1, affecting SharePoint Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. [1] The U.S. Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalog, which signals that the flaw is being used in real intrusions rather than only demonstrated. [2]
The default requirement is modest: a low-privileged authenticated account, network reachability and no user interaction. [1] Dinh Ho Anh Khoa of Viettel Cyber Security published the technical analysis of the mechanism, and that analysis is the basis for the walkthrough below. [3][4]
What SafeControls is supposed to prevent
SharePoint renders pages and web parts from markup. That markup can name server-side classes, and instantiating a class from markup is the same as running code chosen by whoever controls the markup. SafeControls is the control that keeps this from being trivial. It holds a list of classes that a page or web part may instantiate, and a class outside that list does not get created. SafeControls is the boundary between stored configuration data and server-side execution. [3]
Bypassing it is not new. What matters in this case is how the bypass is built.
The two-step reconstruction in ToolPane
The ToolPane component processes Register directives, which map a markup prefix to an ASP.NET control. Its handling runs in two steps. [3][5]
First, it separates the Register directive from the control markup and validates the type name in the directive. Second, it rebuilds the directives, placing attribute values inside double quotes.
Nothing in that second step escapes quotes that are already inside a value. An attacker could close the attribute early and add markup of its own. The reconstructed directive is no longer the directive that was checked.
Because the added directive appears before ASP.NET parses the controls, the checks that already ran do not cover it. [3]
The defect is that validation runs before the text is reconstructed. A validator that runs against text which is later rewritten is only as strong as the rewrite.
From directive injection to code execution
Registering a class that SafeControls would normally reject is the first half. The second half is turning class instantiation into something worth doing. [3][4]
The published chain uses XamlServices.Parse(), the ExpandedWrapper generic and ObjectDataProvider, then LosFormatter deserialization. Each of these is a normal .NET facility that reaches further than its name suggests when it is handed attacker-controlled input. Together they form a code-execution gadget for the class the bypass made instantiable. [4]
The result does not have to be a file on disk. The published approach creates an in-memory web shell, which leaves no web shell file for a scanner to find. This is a response problem. [4]
Who can reach it, and when
Microsoft lists the default case as requiring authentication, with low privileges sufficient. [1] That is narrower than a pre-authentication remote exploit, but it changes little for an organisation with many internal users, service accounts and partner accounts.
A wider path exists when SharePoint is configured to allow anonymous access to specific pages. The analysis describes combining this flaw with a separate authentication weakness in ToolPane to reach pre-authentication code execution. [4] Microsoft fixed that anonymous path in an update released on June 9, 2026, so installations carrying that update are not exposed to the combination. [4]
The supporting principle is not limited to the versions Microsoft lists. The analysis states that the same underlying mechanism applies to SharePoint 2013, which reached the end of support in April 2023 and is therefore absent from the affected-product list. [4]
Fixed builds
Microsoft released the fix on August 11, 2026. The fixed builds are SharePoint Server 2016 build 16.0.5565.1001, SharePoint Server 2019 build 16.0.10417.20198 and SharePoint Server Subscription Edition build 16.0.19725.20522. [4] Administrators on SharePoint Server 2016 may need both updates named in the advisory rather than one. [4]
What to check, and in what order
Upgrading first and investigating second destroys the evidence you would need to decide whether the instance was already used. The recommended order is evidence first, patch second. [4]
Preserve volatile data before any restart: IIS logs, Unified Logging Service logs, Windows event logs, PowerShell logs and endpoint telemetry. [4]
Then look for the shape of this attack in the logs:
- POST requests that carry unusual web part markup or encoded XAML content.
- Activity from low-privileged accounts that normally do not publish pages or web parts.
- Worker process behaviour that does not match the site's normal profile, unexpected child processes and assemblies that do not belong to an approved deployment. Memory-resident implants are why this list emphasises process and memory evidence over file scanning. A file-based check can come back clean on a server that is still compromised. [4]
A testing checklist that does not depend on the CVE
Validation-order bugs are easy to reproduce in code review without a live target. Two questions cover most of them.
Does any validation run against a representation of the input that is later rebuilt, re-encoded or re-serialised before use? If yes, the check and the use are looking at different strings.
Can a value that reaches a directive, template or query construction carry the delimiter that closes the surrounding context? If yes, the delimiter needs escaping at the point of reconstruction, not only at the point of parsing.
Both questions apply to template engines, query builders and configuration generators well beyond SharePoint, which is what makes this class of bug worth adding to a review checklist rather than treating as vendor-specific.
References
[1] Microsoft Security Update Guide, CVE-2026-65660.
[2] CISA Known Exploited Vulnerabilities catalog.
[3] Viettel Cyber Security technical analysis of the CVE-2026-65660 SafeControls bypass, as summarised by 51Testing.
[4] Microsoft SharePoint RCE flaw technical coverage, FreeBuf.
[5] SharePoint Server security update summary, Tencent News.
Top comments (0)