Vulnerabilities

Microsoft's own advisory for CVE-2026-65660 calls it a spoofing bug and scores it 6.5. The CVE record itself, updated on September 11, and the National Vulnerability Database both call it code injection leading to remote code execution, scored 8.8. Anyone who triages patches by Microsoft's bulletin category, rather than the CVE record's own score, would have put this one in next month's batch instead of this week's.

It affects on-premises SharePoint Server 2016, 2019 and Subscription Edition, not SharePoint Online. An attacker with any authenticated, low-privileged account can reach it, no admin rights or special role needed, and end up running code on the server. Microsoft shipped the fix on August 11, 2026. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 25, confirming active exploitation, with a federal remediation deadline of September 28, three days later.

How it works

SharePoint keeps a SafeControls list, an allowlist of the .NET control classes it will load into a page from web part markup. It exists so that editing a page, something any contributor can do, can never load arbitrary server-side code: only classes an administrator has explicitly registered are allowed to run.

The ToolPane is the panel SharePoint shows when a user adds or configures a web part on a page. When a user submits web part markup through it, SharePoint reconstructs a Register directive, the ASP.NET page directive that names the assembly and class behind a control tag, by writing the submitted attribute values back out between double quotes. It does not escape a quote character if one appears inside the value it is writing.

That is the whole bug. An attacker puts a quote inside an attribute value. The quote closes the attribute early, and the remainder of the value opens a second Register directive of the attacker's own choosing, naming a class that was never on the SafeControls list. Because this second directive appears after the point in processing where the SafeControls check already ran, it is never checked at all. SharePoint loads the class and runs it, and it runs as the IIS application pool identity, the service account the SharePoint web application runs under, not as the low-privileged account the attacker logged in with.

What attackers are doing

Microsoft's August 11 update fixed the flaw by disabling the vulnerable function, ToolPane.GetPartPreviewAndPropertiesFromMarkup(), by default, but filed it under a spoofing advisory at 6.5. The correction only landed in the CVE record itself five weeks later, on September 11, by which point most teams had stopped rereading a bulletin they had already triaged.

By late September, threat intelligence firm Previdian reported exploit attempts that chain CVE-2026-65660, which needs an authenticated account, with a separate bug that lets an attacker reach the same ToolPane code path without logging in first. That second flaw has no confirmed public CVE number, so treat it as an unnamed, unverified delivery mechanism rather than a fact. What is confirmed is that the authenticated flaw alone was enough for CISA to list CVE-2026-65660 as actively exploited, and that some attackers are trying to skip the authentication step on farms that allow anonymous page access.

CISA only lists a flaw in the KEV catalog once it has its own evidence of exploitation in the wild. A three-day remediation window is short even by KEV standards, which is CISA's way of marking this one as urgent.

What to do

1. Patch to the fixed build

Install the August 11, 2026 security update for your edition: SharePoint Server 2016 goes to build 16.0.5565.1001 (KB5002905), SharePoint Server 2019 to 16.0.10417.20198 (KB5002894), and SharePoint Server Subscription Edition to 16.0.19725.20522 (KB5002893). Confirm the build on every front-end and application server with (Get-SPFarm).BuildVersion.ToString() from a SharePoint Management Shell, since a farm is only as patched as its slowest node.

2. If you cannot patch today

Cut who can reach the ToolPane code path. Limit page-edit and web-part permissions to the smallest group that actually needs to design pages, rather than every contributor, and check for any web application or zone with anonymous access turned on. Anonymous access is what lets the unauthenticated chaining attempts reach the flaw at all, so turning it off, even temporarily, removes that path even though the authenticated bug remains until you patch.

3. Check whether you were already hit

Look at your IIS logs for POST requests to ToolPane.aspx from accounts or at times that do not match normal editing activity. Check the SharePoint ULS logs, the product's own diagnostic logs, for errors around the same timestamps. Watch for w3wp.exe, the IIS worker process that runs SharePoint, spawning child processes such as cmd.exe or powershell.exe, which normal SharePoint operation never does. And look under the LAYOUTS and wpresources folders in the SharePoint hive for files your own deployment or update process did not put there.

4. If you find signs of compromise

The injected code ran as the application pool identity that every server in the farm trusts, so treat the whole farm as compromised, beyond the one node where you found the file or the log line. Rotate the farm's machine keys, the farm account and application pool service account credentials, and the passwords on the IIS application pool identities themselves, since code ran with exactly those permissions. Then review site collection admin lists and permission changes made since August 11 for anything nobody on your team made.

Cross-check the CVE record's own CVSS score against Microsoft's bulletin category for every monthly SharePoint and Exchange update, not only the category headline Microsoft assigns at release. The category is Microsoft's read of the bug on day one; the score attached to the CVE record is what should set your patch timeline, and here the two disagreed by an entire severity tier for five weeks.

Our web application penetration tests look for exactly this kind of allowlist bypass in server-rendered applications like SharePoint, and our attack surface management work flags on-premises farms still reachable from outside your admin network. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Microsoft Security Response Center, CVE-2026-65660, CISA Known Exploited Vulnerabilities catalog, CISA alert, September 25, 2026, The CyberSec Guru technical writeup, Petri IT Knowledgebase, CVE Security.