CVE-2026-65660 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-11

Added to CISA KEV: 2026-09-25 45 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE: Apply Microsoft's August 2026 security updates — SharePoint 2016 to 16.0.5565.1001+, SharePoint 2019 to 16.0.10417.20198+, SharePoint SE to 16.0.19725.20522+
IMMEDIATE for internet-facing instances: Treat as critical priority given public exploit chain documentation and potential authentication bypass via chaining
Review SharePoint logs for anomalous ToolPane or XAML-related activity indicative of exploit attempts or webshell deployment
Search for indicators of in-memory webshell activity: unusual IIS worker process network connections, unexpected child processes spawned from w3wp.exe, anomalous XAML parsing activity
If immediate patching is not feasible: restrict SharePoint access to VPN-authenticated users and implement IP allowlisting to reduce internet exposure surface
Enable enhanced SharePoint ULS logging and forward to SIEM — monitor for suspicious code injection patterns in ToolPane feature
Audit all authenticated SharePoint user accounts — revoke unnecessary permissions and enforce MFA to raise the bar for the PR:L exploitation requirement
Consider WAF rules targeting XAML injection patterns in SharePoint request parameters as a temporary mitigation
Patch priority: CRITICAL for internet-facing deployments, HIGH for intranet-only deployments with external user access

🔍 Web Intelligence (Kagi · 2026-09-25)

Summary

CVE-2026-65660 is a critical security vulnerability involving improper control of code generation (code injection) in Microsoft Office SharePoint Server. While initially classified by Microsoft as a spoofing vulnerability, it was later re-evaluated as an authenticated Remote Code Execution (RCE) flaw. This vulnerability is significant because it allows an attacker with authorized access to achieve remote code execution, potentially leading to full system compromise, and researchers have noted that it can theoretically be chained with other flaws to bypass authentication requirements entirely.

Exploitation

Active Exploitation: There are no reports of active, in-the-wild exploitation of this vulnerability as of September 2026.
Threat Actors/Campaigns: No known threat actors or specific ransomware campaigns have been linked to this vulnerability.
PoC/Exploit Availability: Public technical analysis exists detailing an exploit chain involving the ToolPane feature and XAML, which can be used to deploy an in-memory webshell.
Attack Prerequisites:

- Authentication: Typically requires an authenticated user; however, security research suggests it can be combined with other flaws to achieve RCE without prior authentication. - Access Vector: Network-based. - User Interaction: No specific user interaction is required for the technical exploit to function once the attacker has achieved the necessary entry point.

Affected Products & Patches

Affected Products: Microsoft SharePoint Server.
Patch Availability: Microsoft released security updates addressing this vulnerability on August 11, 2026.
Mitigations: Organizations should ensure they have applied the official patches provided in the August 2026 security release cycle. If patching is not immediately feasible, restrict access to the SharePoint environment to trusted users and monitor for anomalous behavior involving ToolPane or XAML-related activities.

Impact

Access/Capabilities: Successful exploitation grants an attacker the ability to execute arbitrary code on the affected SharePoint server, which can be leveraged to establish persistence via in-memory webshells and potentially move laterally within the network.
Business Risk: For internet-facing SharePoint deployments, this vulnerability represents a severe risk. An attacker who gains a foothold—or chains this with other vulnerabilities to bypass authentication—could result in complete data exfiltration, service disruption, or total compromise of the SharePoint infrastructure.