Microsoft SharePoint flaw enables authenticated code execution

Microsoft’s advisory described CVE-2026-65660 as a spoofing issue, but the separate record it published for the same flaw described it as a remote code execution vulnerability. The National Vulnerability Database gave it a score of 8.8.

Khoa published the technical details and said the weakness lay in the way SharePoint checked SafeControls entries. He said the ToolPane component rebuilt Register directives without escaping embedded quotes, which let an attacker add directives and load arbitrary .NET classes.

Khoa said class loading could then be used to trigger code execution through XamlServices.Parse(), and that his write-up included a working in-memory webshell payload. He also said the flaw could be paired with a patched authentication bypass to reach pre-authentication code execution on systems that allowed anonymous page access.

The researcher said the bypass had been fixed in a June 9 patch, so systems that had applied it were not exposed to that route. Microsoft said exploitation was unlikely, and no in-the-wild exploitation had been reported; Khoa said he had used the exploit in penetration testing.

Khoa also said SharePoint 2013 was affected, although Microsoft’s advisory listed only 2016, 2019 and Subscription Edition. SharePoint 2013 has been out of support since April 2023 and does not receive security updates.