Microsoft SharePoint Server faces a critical vulnerability, CVE-2026-65660, which was initially classified as a minor spoofing flaw but has been revealed to facilitate authenticated remote code execution (RCE). Detailed research by Dinh Ho Anh Khoa of Viettel Cyber Security shows the flaw affects SharePoint Server 2016, 2019, and Subscription Edition, carrying a CVSS score of 8.8.
The vulnerability exists in how SharePoint validates server-side controls against the SafeControls list. By exploiting unescaped quotes in the ToolPane component, an attacker can inject directives to load arbitrary .NET classes and trigger code execution via XamlServices.Parse() deserialization. Although no wild exploitation is currently reported, the publication of a functional in-memory webshell payload increases the risk for unpatched systems.
