Exploited SharePoint RCE Vulnerability Details Disclosed

TL;DR

Threat actors are actively attacking on-premises servers by exploiting a critical SharePoint RCE vulnerability tracked as CVE-2026-65660. Security researchers also released detailed technical analysis and exploit workflows to the public. Administrators must install official Microsoft security updates immediately to protect corporate networks from remote compromise.

Why It Matters

Industry telemetry estimates that hundreds of thousands of enterprise organizations host Microsoft SharePoint on local servers. Consequently, a defect in this core collaboration portal creates severe risks for corporate infrastructure. The vulnerability carries an Important CVSS base score of 8.8. When chained with an anonymous access bug, the flaw enables unauthenticated remote code execution.

Threat intelligence teams confirm that active exploitation is already occurring in the wild. In a threat intelligence alert from Previdian, researchers noted live intrusion traffic. Specifically, analysts confirmed, “Previdian observed SharePoint exploit attempts chaining CVE-2026-65660 (authenticated) with a separate anonymous delivery bug documented by @vcslab.” These attacks deliver an encrypted loader to establish server control. Furthermore, public availability of exploit details dramatically elevates exposure for unpatched systems. Delaying updates leaves enterprise documents and internal credentials exposed to immediate theft.

Previdian observed SharePoint exploit attempts chaining CVE-2026-65660 (authenticated) with a separate anonymous delivery bug documented by @vcslab.

Attempts were carrying an encrypted .NET loader. Anonymous viewing required. pic.twitter.com/Ca7MzL3iY9

— Previdian (@PrevidianCyber) September 24, 2026

How The Attack Works

The flaw stems from improper code generation in the ToolPane markup parsing pipeline. Researcher khoadha from VCSLab published a complete technical analysis of CVE-2026-65660 explaining the mechanism. The researcher noted, “That is in-memory webshell technique and more importantly, this can combine with another bug to achieve RCE without any authentication.”

Bypassing SafeControls Restrictions

The vulnerability targets how SharePoint verifies custom controls before rendering web parts. When an administrator requests a component preview, the server parses directive tags. However, the internal markup generator constructs strings unsafely. As the researcher highlighted, “the logic is simple, just append the attribute value to a format without any check.” Attackers inject single and double quotes into directive attributes to break out of string boundaries. This injection splits malicious register directives across both tag elements and directive blocks. As a result, the input bypasses the safe type verification routines completely.

Executing In-Memory Payloads

After bypassing type checks, the parser processes untrusted controls using the TemplateParser engine. Attackers configure an ObjectDataProvider gadget wrapped inside an ExpandedWrapper container. The engine then invokes XamlServices to deserialize a LosFormatter payload directly in memory. This technique deploys an in-memory web shell without writing files to local disk storage. Finally, attackers bypass authentication barriers by posting the payload to pages that inherit WebPartPage, such as AddGallery.aspx. Any server allowing anonymous page viewing executes the payload under service account privileges.

Affected Versions

This critical SharePoint RCE vulnerability affects all modern on-premises SharePoint editions. Specifically, the flaw impacts Microsoft SharePoint Server 2013, 2016, 2019, and Subscription Edition. Systems with internet-facing endpoints allowing anonymous viewing face the highest risk.

Patch Or Mitigation Steps

Administrators should deploy vendor security patches without delay. Microsoft resolved the flaw in its August 2026 cumulative updates. The update disables vulnerable markup preview functions by default. If patching requires time, administrators should disable anonymous access across all web applications. Applying these defenses eliminates exposure to this active SharePoint RCE vulnerability.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.