CISA Orders Federal Agencies to Patch a SharePoint RCE Flaw Microsoft First Called Spoofing

CISA has given federal civilian agencies until September 28 to patch a Microsoft SharePoint vulnerability that is now under active attack, two days after a security researcher published its full technical details. CVE-2026-65660 lets an authenticated, low-privilege attacker execute arbitrary code on an on-premises SharePoint server with no user interaction required, and the National Vulnerability Database rates it 8.8 out of 10. Microsoft’s own public advisory, though, still describes the same bug very differently.

A Label That Undersold the Risk

Anyone triaging patches off Microsoft’s public Security Update Guide entry for CVE-2026-65660 sees a spoofing vulnerability, rated 6.5, with Microsoft’s own severity fields showing no impact to integrity or availability. The separate CVE record Microsoft publishes for the same flaw tells a different story: that record, quietly updated on September 11, titles the bug a remote code execution vulnerability and carries the 8.8 score NVD also lists. Both records point to the same underlying weakness, CWE-94, code injection.

Viettel Cyber Security researcher Dinh Ho Anh Khoa reported the bug to Microsoft and published the full technical breakdown on September 22. The Hacker News noted that defenders who triaged the vulnerability off the advisory alone would have seen a moderate spoofing flaw, not a code execution bug with a near-maximum score.

How an Attacker Actually Gets Code Running

The vulnerable code lives inside SharePoint’s ToolPane component, specifically the function that processes web part markup, ToolPane.GetPartPreviewAndPropertiesFromMarkup(). SharePoint is supposed to check every control a page tries to load against an allowlist called SafeControls, using a function named EditingPageParser.VerifyControlOnSafeList(), a defense meant to stop dangerous .NET classes from ever running. According to GBHackers‘ technical writeup, the process separates a page’s Register directives from its surrounding markup, validates each directive on its own, and only recombines everything afterward, when the final content gets parsed. SharePoint also handles quotation marks inside those Register directive attributes insecurely, which lets an attacker inject extra directives after the SafeControls check has already run, so those directives are never actually validated.

With a malicious directive past the checkpoint, an attacker can register a .NET class SharePoint would normally block, then trigger it with XamlServices.Parse() alongside deserialization gadgets such as ObjectDataProvider and LosFormatter to execute arbitrary code. Because the resulting webshell can live entirely inside SharePoint’s own worker process rather than being written to disk, it leaves less of the file-based evidence that antivirus and endpoint tools are built to catch.

CVE-2026-65660 is fundamentally an authenticated bug: NVD’s CVSS vector requires low-level privileges and no user interaction. Khoa’s own research describes a narrower path to pre-authentication compromise on SharePoint deployments that allow anonymous access to certain pages, since a page built on WebPartPage with a Web Part zone can initialize ToolPane without the login check a normal ToolPanePage would enforce. He separately demonstrated the bug can also be chained with an unrelated authentication bypass Microsoft already patched on June 9, though servers that applied that earlier fix are not exposed through that specific route.

Two Days From Public Details to Active Exploitation

Microsoft shipped the fix for CVE-2026-65660 on August 11 as part of its regular Patch Tuesday updates, and the update turns off the vulnerable ToolPane parsing behavior by default, according to Khoa’s writeup. As of his September 22 disclosure, no exploitation had been publicly reported and the bug was not yet in CISA’s Known Exploited Vulnerabilities catalog.

That changed within 48 hours. SecurityWeek reported that threat intelligence platform Previdian, formerly known as KEVIntel, saw the first exploitation attempts on September 24, and attempts to create a webshell backdoor the following day. On September 25, Microsoft updated its advisory to say, “As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.” CISA added CVE-2026-65660 to its KEV catalog that same day, with a due date of September 28 for federal civilian agencies, and flagged the entry for its Forensics Triage Requirements, guidance CISA applies to KEV vulnerabilities capable of full system takeover and that requires agencies to check whether a system was already compromised, not just patch it. It remains unclear who is behind the attacks.

A Repeat Pattern for SharePoint

Khoa is the same researcher who demonstrated the original ToolShell exploit chain against SharePoint at Pwn2Own Berlin in May 2025, a chain that Chinese state-backed hacking groups went on to exploit and that triggered emergency patches from Microsoft. He has kept finding SharePoint bugs since: CVE-2026-55040, an authentication bypass he disclosed in August, was also exploited shortly after its technical details went public, according to The Hacker News.

CISA’s KEV catalog now lists 16 SharePoint vulnerabilities in total, and 8 of those were discovered and patched this year alone, SecurityWeek reported, underscoring how consistently the platform has become a target once a fix, and the research explaining it, becomes public.

What SharePoint Administrators Should Do Now

Organizations running on-premises SharePoint Server 2016, 2019, or Subscription Edition that have not yet applied the August 11 security updates should treat that as the immediate priority; the update disables the vulnerable ToolPane behavior by default. Khoa’s research indicates the underlying bug also affects SharePoint 2013, but Microsoft’s advisory does not list it, since that version has been out of support and unpatched since April 2023, leaving replacement or isolation as the only real option for any farm still running it.

Beyond patching, administrators should confirm the June 9 authentication bypass fix is also in place, review whether anonymous page access is enabled on any public facing SharePoint deployment, and watch for the signs researchers have tied to this specific attack: unusual child processes spawned from SharePoint’s worker process, unexpected requests to Web Part or gallery pages, and abnormal .NET deserialization activity in logs.