SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
A SharePoint Server vulnerability, initially misclassified as a spoofing issue, allows authenticated remote code execution. Researcher Dinh Ho Anh Khoa discovered a chain of exploits that was subsequently used by Chinese state-backed groups, leading to emergency patches from Microsoft. The vulnerability stems from how SharePoint handles server-side controls and can be chained with a separate authentication bypass.
A SharePoint Server vulnerability, initially classified by Microsoft as a spoofing flaw with a CVSS score of 6.5, has been revealed to enable authenticated remote code execution. Researcher Dinh Ho Anh Khoa discovered this critical vulnerability and demonstrated a ToolShell exploit chain at Pwn2Own Berlin in May 2025, which was later exploited by Chinese state-backed groups, prompting Microsoft to release emergency patches on August 11th. The root cause lies in how SharePoint checks whether server-side controls are on the SafeControls list. When the ToolPane component processes web-part markup, it reconstructs Register directives by writing attribute values between double quotes without escaping quotes inside them. An attacker can inject additional directives through unescaped quotes, registering arbitrary .NET classes after the type check runs but before the control is loaded.
Using XamlServices.Parse(), an attacker can trigger code execution through deserialization. Khoa provided a working in-memory webshell payload that bypasses registry permission failures encountered by other deserialization methods. He also demonstrated that the vulnerability can be chained with a separate, already-patched authentication bypass to reach pre-authentication remote code execution on servers configured to allow anonymous page access. The authentication bypass was fixed in a June 9 patch, and servers that applied the fix are not exposed to the pre-authentication path.
No exploitation of CVE-2026-65660 has been reported in the wild, and it is not listed in CISA's Known Exploited Vulnerabilities catalog. Microsoft rates exploitation as unlikely, though the full exploit markup is now publicly available. Khoa has utilized the exploit in penetration testing engagements. The August 11 patch addresses the vulnerability by disabling the vulnerable function by default. While Microsoft's advisory primarily lists 2016, 2019, and Subscription Edition, Khoa notes that SharePoint 2013 is also affected, though it is no longer supported and receives no security updates since April 2023.