CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on September 25, 2026, confirming that a Microsoft SharePoint bug patched over a month ago is now being actively exploited. Microsoft originally shipped the fix on August 11 and — in a detail worth flagging on its own — first classified it as a low-impact spoofing issue. The CVE record was revised on September 11 to its correct classification: remote code execution via code injection. Federal agencies have until September 28 to remediate under BOD 26-04.

What happened

CVE-2026-65660 lives in how SharePoint’s ToolPane component parses web-part markup when it reconstructs ASP.NET Register directives. SharePoint is supposed to gate which server-side controls can be loaded through the SafeControls allowlist in web.config — a control has to appear on that list, by assembly and namespace, before SharePoint will instantiate it. The parser that rebuilds Register directive attribute values writes them back out between double quotes without escaping embedded quote characters. An attacker who can smuggle a quote character into an attribute value can terminate the directive early and inject a second, attacker-controlled Register directive of their own — one that names an arbitrary .NET type.

Because the allowlist check runs against the parser’s (already-corrupted) view of the directive rather than what actually gets loaded, the check passes while a different, non-allowlisted class gets registered and instantiated. That’s a classic parser-desynchronization bug: the validator and the executor disagree about what the input says.

The catch that kept Microsoft’s initial severity call defensible on paper — the attacker needs to be authenticated. In practice this bar is low: the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) specifies PR:L, meaning any authenticated SharePoint user, including a Site Member with the lowest permission tier available, has everything needed to trigger it. That’s the same permission level a user gets just by being invited to upload files to a single team site.

Technical details

  • CVE: CVE-2026-65660
  • CWE: CWE-94, Improper Control of Generation of Code (“Code Injection”)
  • CVSS 3.1: 8.8 High
  • Affected: SharePoint Server 2016 (Enterprise), SharePoint Server 2019, SharePoint Server Subscription Edition. SharePoint Online is not affected — Microsoft manages patching there directly.
  • Patched builds: SE 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001 (all shipped August 11, 2026)
  • Exploitation requirement: valid low-privilege SharePoint credentials plus network reachability to the ToolPane endpoint
  • KEV addition date: September 25, 2026; federal remediation deadline September 28, 2026

The exploit path is a variant of the SafeControls-bypass technique that has recurred across several SharePoint RCE chains this year, including the ToolShell family from mid-2026 — attackers keep finding new parser-level ways to get an unlisted class loaded rather than attacking the allowlist enforcement directly. Once an arbitrary .NET class is registered and instantiated inside the SharePoint worker process (w3wp.exe), the attacker inherits whatever the farm’s application pool service account can reach: content databases, other farm servers, and frequently a path into Active Directory via user-profile synchronization.

Impact

Any on-premises SharePoint farm running an unpatched build is exposed to any user (or compromised credential) with even the lowest authenticated role. Given that infostealer logs and phishing kits routinely yield exactly this class of low-privilege corporate credential, “authenticated” is not a meaningful barrier here — it just means the attacker needs any foothold at all, not admin rights. CISA’s KEV addition confirms this is no longer theoretical; exploitation is happening now, over a month after the patch was available, which points to a large population of unpatched internet- or intranet-facing farms.

Mitigation

  • Patch immediately if you haven’t already: install the August 2026 SharePoint security update for your branch (SE, 2019, or 2016 Enterprise) and re-run the SharePoint Products Configuration Wizard (PSConfig) afterward — skipping this step is a recurring cause of “patched but still vulnerable” reports.
  • Federal agencies: BOD 26-04 sets a September 28, 2026 deadline; treat this as urgent regardless of sector.
  • Audit SharePoint access logs for anomalous requests to ToolPane/web-part endpoints and for Register directive strings containing unexpected quote characters or unfamiliar assembly/namespace pairs.
  • Review and, where possible, tighten Site Member and other low-tier role assignments; rotate credentials for any account known to be present in infostealer dumps.
  • If immediate patching isn’t possible, restrict farm access to VPN/ZTNA and monitor w3wp.exe for unexpected child processes or outbound connections.

Microsoft’s advisory is on the MSRC update guide. CISA’s catalog entry and BOD 26-04 guidance are at the CISA KEV catalog.