A SharePoint Server vulnerability tracked as CVE-2026-65660 turned out to be far more serious than Microsoft first indicated. The company originally described it as a spoofing issue with a CVSS score of 6.5. In reality, it is an authenticated RCE flaw rated 8.8. That gap matters, because security teams that trusted the first label may have pushed the patch further down their to-do lists.
What the CVE-2026-65660 RCE Flaw Does?
Dinh Ho Anh Khoa, a researcher at Viettel Cyber Security, discovered the bug. Microsoft credits him as “khoadha.” The flaw affects SharePoint Server 2016, 2019, and Subscription Edition, and it stems from improper validation of the SafeControls list.
An attacker can use unescaped quotes to slip malicious Register directives past that validation. They can then run arbitrary .NET classes through deserialization in XamlServices.Parse(), which opens the door to deploying an in-memory webshell.
Microsoft’s executive summary states that “improper control of generation of code (‘code injection’) in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.”
The weakness is categorized as CWE-94. According to the company’s FAQ, an authenticated attacker with low-level access could send a specially crafted request to run code on the server, with no user interaction required.
Inside Microsoft’s Revised SharePoint Advisory
Microsoft published the advisory on August 11, 2026. It issued version 1.1 on August 27, updating the impact field in the Security Updates table, the CVE title, and the FAQs, and it called the revision “an informational change only.”
The advisory now lists the impact as Remote Code Execution, with a maximum severity of Important. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, which gives a base score of 8.8 and a temporal score of 7.7. That means the attack comes over the network with low complexity, requires low privileges and no user interaction, leaves scope unchanged, and has high impact on confidentiality, integrity, and availability. Exploit code maturity is rated Unproven, the remediation level is Official Fix, and report confidence is Confirmed.
At original publication, the flaw had not been publicly disclosed or exploited. Microsoft assessed it as “Exploitation Less Likely.”
Patching SharePoint Against the RCE Flaw
The fixes released on August 11 are listed below by edition:
- Subscription Edition: KB 5002893, build 16.0.19725.20522
- SharePoint Server 2019: KBs 5002894 and 5002896, build 16.0.10417.20198
- SharePoint Enterprise Server 2016: KBs 5002905 and 5002906, build 16.0.5565.1001
Microsoft advises customers to install every update offered for their software, in any order. It also confirms that the same KB number covers both SharePoint Server 2016 and SharePoint Enterprise Server 2016.
How a CVE-2026-65660 Attack Could Unfold
Threat analysts mapped the vulnerability onto a cloud kill chain. They rated initial compromise with high confidence. The remaining stages are rated medium confidence and inferred:
- Privilege escalation through the SharePoint service context
- Lateral movement across the farm and connected systems
- Command and control via the webshell
- Data exfiltration
- Operational disruption
A successful attack could expose sensitive organizational data, confidential documents, and user information. It could also disrupt SharePoint collaboration services. The overall confidence for this assessment is medium.
