SharePoint Flaw CVE-2026-65660 Enables In-Memory Pre-Auth RCE

Executive Summary

A critical vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-65660 and scored at CVSS 8.8 (High) by the National Vulnerability Database, enables attackers to achieve remote code execution (RCE) and inject in-memory webshells without leaving disk artifacts. Originally downplayed in Microsoft's initial security advisory as a moderate spoofing issue (CVSS 6.5) with zero integrity impact, subsequent technical disclosures by Viettel Cyber Security researcher Dinh Ho Anh Khoa confirm the flaw is a complete SafeControls filter bypass that grants arbitrary code execution.

The vulnerability impacts on-premises installations of SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (SE), as well as unsupported SharePoint Server 2013 instances. While weaponization primarily requires authenticated access, researchers demonstrated that the flaw can be chained with default anonymous access configurations on internet-facing WebPart pages to achieve full pre-authentication remote code execution. Because weaponized exploit markup and technical call traces are now fully public, unpatched enterprise servers face severe compromise risks.

Technical Vulnerability Analysis & Attack Chain

SharePoint implements strict server-side template sandboxing to prevent administrators and site designers from executing unauthorized .NET code. Dynamic web parts submitted through user requests are vetted against an internal SafeControls allowlist managed by EditingPageParser.VerifyControlOnSafeList(). CVE-2026-65660 exposes a parser desynchronization flaw within this mechanism.

1. Directive Splitting & Quote Injection

When processing dynamic WebPart markup inside Microsoft.SharePoint.WebPartPages.ToolPane.GetPartPreviewAndPropertiesFromMarkup(), SharePoint utilizes ServerElementMarkupSource to decouple <%@ Register ... %> directives from server control tags. The directives are parsed, validated, and subsequently reconstructed back into raw markup via Microsoft.Web.Design.RegisterDirective.GetHtml():

public void GetHtml(TextWriter sw, bool includeCodeAssembly)
{
    sw.Write("<%@ Register");
    // ...
    string src = this.Src;
    if (src != null && src.Length > 0)
    {
        sw.Write(" Src=\"");
        sw.Write(src);
        sw.Write("\"");
    }
    sw.Write(" %>");
}

The GetHtml() method writes attribute strings directly between double quotes (") without sanitizing or escaping quotes nested inside attribute values. An attacker supplies single-quoted attributes containing embedded double quotes (Src='/_controltemplates/15/AclEditor.ascx" ...'), terminating the current attribute and injecting unparsed directive parameters.

2. Two-Phase SafeControls Bypass

EditingPageParser.VerifyControlOnSafeList() executes verification in two distinct phases:

1. It validates the server control tag markup against existing registered type names.
2. It verifies processed Register directive strings sequentially.

By injecting an unclosed directive containing ignoreParentFrozen=' into the Register blob and completing the tag declaration inside the server tag payload, the attacker exploits TemplateParser.ProcessAttributes(). The parser skips the ignoreParentFrozen attribute while in designer mode. When SharePoint concatenates the directive and tag streams, an unauthorized directive registering arbitrary .NET assemblies bypasses validation entirely.

3. In-Memory Webshell via XamlServices.Parse Deserialization

To weaponize arbitrary class loading, the exploit bypasses standard ASP.NET lifecycle hooks (OnInit, OnLoad), which are subjected to secondary safety checks in DocumentDesigner. The attacker invokes System.Xaml.XamlServices.Parse():

• Unlike System.Windows.Markup.XamlReader.Parse(), which fails due to Windows Event Tracing (EventTrace) registry permission errors in unprivileged IIS application pools, XamlServices.Parse() executes cleanly without touching the registry.
• By wrapping XamlServices.Parse within System.Data.Services.Internal.ExpandedWrapper alongside System.Windows.Data.ObjectDataProvider, the attacker deserializes an ActivitySurrogateSelector payload formatted via LosFormatter.
• The payload dynamically injects an in-memory webshell (memshell) directly into the w3wp.exe worker process, intercepting HTTP requests without dropping .aspx files onto the host file system.

4. Pre-Authentication Chaining Vector

While ToolpanePage.OnInit enforces SPUtility.EnsureAuthentication(), any standard page inheriting from WebPartPage that contains a WebPartZone executes ToolPaneCreationAndInitialization(). On internet-facing SharePoint web applications where Anonymous Access is enabled for public portals, an unauthenticated attacker issues a direct POST request to endpoints such as /_layouts/15/AddGallery.aspx?DisplayMode=Edit&a=/ToolPane.aspx, triggering the full exploit chain prior to authentication.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

• Research Attribution (Viettel Cyber Security): The vulnerability was researched and disclosed by Dinh Ho Anh Khoa of Viettel Cyber Security. Khoa is the original author of the "SharePoint ToolShell" exploit chain demonstrated at Pwn2Own Berlin in May 2025.
• Adversary Targeting & Exploitation History: Previous SharePoint vulnerabilities discovered by the same research group (such as ToolShell and CVE-2026-55040) were weaponized by sophisticated nation-state threat groups within weeks of public disclosure. Documented adversaries targeting SharePoint flaws include Chinese state-sponsored clusters (tracked as Linen Tempest and Storm-0062), who systematically target enterprise collaboration portals for corporate espionage and credential harvesting.
• Current In-the-Wild Status: While Microsoft initially flagged exploitation as "less likely" and CISA has not yet added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, the release of full functional proof-of-concept markup significantly escalates the risk of widespread automated scanning and exploitation against perimeter servers.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Apply Official Microsoft Updates:
  • Deploy the August 11, 2026 cumulative security update (KB5002893) across all SharePoint farms immediately.
  • The update sanitizes double quote parameters in RegisterDirective.GetHtml() and disables ToolPane.GetPartPreviewAndPropertiesFromMarkup() by default.
• Restrict Anonymous Access:
  • Audit web applications hosting SharePoint content. If external anonymous access is not strictly required, disable it across all public zones via SharePoint Central Administration -> Application Management -> Manage Web Applications -> Authentication Providers.
• Decommission Unsupported Versions:
  • SharePoint Server 2013 reached official End of Life (EOL) in April 2023 and does not receive security patches. Disconnect or migrate all legacy 2013 farms immediately.

2. Network & Perimeter Defenses

• WAF Inspection Rules:
  • Inspect incoming HTTP POST requests directed to /_layouts/15/AddGallery.aspx, /_layouts/15/ToolPane.aspx, and GetWebPartPageConnectionInfo.
  • Block requests containing URL-encoded directive injection artifacts, such as %40Register, ExpandedWrapper, XamlServices, or ObjectDataProvider in request bodies.
• Perimeter Edge ACLs:
  • Restrict access to administrative layout endpoints (/_layouts/15/*) to internal management subnets and trusted VPN gateways.

3. Endpoint Detection & Hunting Query

Sigma Rule: Suspicious In-Memory Web Part Deserialization on SharePoint Hosts

title: SharePoint ToolPane SafeControls Deserialization Exploit
status: experimental
description: Detects w3wp.exe executing XamlServices deserialization or spawning child shells following ToolPane requests.
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\conhost.exe'
  selection_cli:
    CommandLine|contains:
      - 'XamlServices'
      - 'ExpandedWrapper'
      - 'ObjectDataProvider'
      - 'LosFormatter'
  condition: selection_process or selection_cli
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1203

Microsoft Defender for Endpoint (KQL) Hunting Query: SharePoint In-Memory Webshell Activity

// Detect suspicious child processes or memory anomalies originating from SharePoint IIS worker processes
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("SharePoint", "w3wp.exe -ap")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "nltest.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by Timestamp desc