ToolShell's author publishes a working code-execution exploit for SharePoint's CVE-2026-65660
Dinh Ho Anh Khoa's writeup turns CVE-2026-65660 into authenticated remote code execution on SharePoint 2016, 2019 and Subscription Edition. Microsoft's advisory scores the flaw 6.5 and calls it spoofing. NVD scores it 8.8.
The Watch · Security desk
What happened
- Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details for CVE-2026-65660, showing the SharePoint Server flaw gives an authenticated attacker remote code execution.
- Patches have been available since the August 11 security updates, which according to Khoa also turn the vulnerable function off by default.
- No exploitation has been reported in the wild and the flaw is absent from CISA's Known Exploited Vulnerabilities catalog, but the exploit markup is now published.
Why it matters
- What doesn't add up contradiction Two records Microsoft publishes for the same CVE disagree on impact class, so a triage queue fed by the advisory and one fed by NVD will rank the same SharePoint farm differently.
- Who's exposed exposure Farms that allow anonymous page access and applied neither the June 9 nor the August 11 update can now be reached without credentials using published markup.
- What it sets up precedent Khoa's previous SharePoint bypass drew exploitation shortly after publication, so remediation planning here should assume attempts before the next quarterly window.
- Who has to decide decision If Khoa's affected-version list is right, SharePoint 2013 operators have no update to install and must choose between isolating the servers and moving off them.
Next story · Security · Oct 1
Warlock ransomware group narrows its targets to large Spanish- and Portuguese-speaking organizationsConfirmed6 publishers
The bug is in how SharePoint checks its SafeControls list, the filter that stops dangerous classes loading. When the ToolPane component processes web-part markup, it rebuilds Register directives by writing attribute values between double quotes and does not escape quotes inside those values [10]. An attacker closes a quote early and injects additional directives. That registers arbitrary .NET classes after the type check has run and before the control is loaded [11]. From there the exploit calls XamlServices.Parse() and gets code execution through deserialization [12]. Khoa's writeup includes a working in-memory webshell that, he said, avoids the registry permission failures other deserialization methods encounter [2].
Two records Microsoft publishes describe that outcome differently. The advisory says an authorized attacker can perform spoofing, and assigns no impact to integrity or availability [23]. The CVE record, updated on September 11, titles the same flaw a remote code execution vulnerability and says an authorized attacker can execute code [5]. The National Vulnerability Database scores it 8.8, which is 2.3 points above the advisory's 6.5 [4][24]. Both records assign CWE-94, a code-injection weakness [6]. Anyone who ranked this in August off the advisory queued a moderate spoofing bug [9].
The patch shipped in the August 11 security updates, and according to Khoa it also turns the vulnerable function off by default [7][8]. The reclassification arrived 31 days later [25]. For farms patched on schedule, the label mismatch cost nothing. For farms where a 6.5 spoofing flaw was deferred to a quarterly window, the exploit markup is now public and the server is still vulnerable [14].
Khoa also chained the flaw with a separate authentication bypass to reach pre-authentication code execution on servers configured to allow anonymous page access [17]. He says that bypass was fixed in a June 9 patch and that servers which applied it are not exposed on that path [18]. Farms missing both the June and August updates take this unauthenticated [22].
Khoa's earlier SharePoint disclosures were picked up quickly. He demonstrated the original ToolShell chain at Pwn2Own Berlin in May 2025, Chinese state-backed groups later exploited it, and Microsoft shipped emergency patches [19]. His CVE-2026-55040 authentication bypass was exploited shortly after the details became public in August [20].
No exploitation of CVE-2026-65660 has been reported in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog [13]. Microsoft rates exploitation unlikely [14]. Khoa says he has used the exploit in penetration testing engagements [21]. He also says SharePoint 2013 is affected, while Microsoft's advisory lists only 2016, 2019 and Subscription Edition [15]. SharePoint 2013 has received no security updates since support ended in April 2023 [16].
What to watch
- Whether Microsoft revises the advisory's impact class, CVSS score or exploitability rating to match its own CVE record.
- Whether CVE-2026-65660 enters CISA's KEV catalog, which would confirm exploitation of the published ToolPane path.
- Whether Microsoft adds SharePoint 2013 to the affected-products list, since that version gets no security updates.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details showing that CVE-2026-65660 enables authenticated remote code execution in SharePoint Server.
- [2]
The writeup includes a working in-memory webshell payload that avoids the registry permission failures other deserialization methods encounter, Khoa said.
- [3]
CVE-2026-65660 affects SharePoint Server 2016, 2019 and Subscription Edition.
- [4]
The National Vulnerability Database scores CVE-2026-65660 at 8.8.
- [5]
The CVE record that Microsoft publishes separately, updated on September 11, titles CVE-2026-65660 a remote code execution vulnerability and says it allows an authorized attacker to execute code.
- [6]
Both the Microsoft advisory and the CVE record assign CWE-94, a code-injection weakness.
- [7]
Patches for CVE-2026-65660 have been available since the August 11 security updates.
- [8]
The August 11 patch fixes the flaw and turns off the vulnerable function by default, according to Khoa.
- [9]
Defenders who triaged CVE-2026-65660 based on Microsoft's advisory saw a moderate spoofing flaw, not a code-execution vulnerability with a near-maximum score.
- [10]
The flaw sits in how SharePoint checks whether server-side controls are on the SafeControls list; when the ToolPane component processes web-part markup it reconstructs Register directives by writing attribute values between double quotes without escaping quotes inside them.
- [11]
An attacker can inject additional directives through the unescaped quotes, registering arbitrary .NET classes after the type check runs but before the control is loaded.
- [12]
With arbitrary class loading, the attacker uses XamlServices.Parse() to trigger code execution through deserialization.
- [13]
No exploitation of CVE-2026-65660 has been reported in the wild, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog.
- [14]
Microsoft's advisory rates exploitation of CVE-2026-65660 as unlikely, though the full exploit markup is now public.
- [15]
Khoa says the flaw also affects SharePoint 2013, though Microsoft's advisory lists only 2016, 2019 and Subscription Edition.
- [16]
SharePoint 2013 has been out of support since April 2023 and receives no security updates.
- [17]
Khoa demonstrated that the flaw can be chained with a separate, already-patched authentication bypass to reach pre-authentication remote code execution on servers configured to allow anonymous page access.
- [18]
Khoa says the authentication bypass was fixed in a June 9 patch, and servers that applied the fix are not exposed to the pre-authentication path.
- [19]
Khoa demonstrated the original ToolShell exploit chain against SharePoint at Pwn2Own Berlin in May 2025; that chain was later exploited by Chinese state-backed groups and triggered emergency patches from Microsoft.
- [20]
Khoa disclosed CVE-2026-55040, a SharePoint authentication bypass that attackers exploited shortly after its details became public in August.
- [21]
Khoa says he has used the exploit in penetration testing engagements.
- [22]
Servers allowing anonymous page access that applied neither the June 9 bypass fix nor the August 11 patch are reachable on the pre-authentication code execution path.
- [23]
Microsoft's advisory describes CVE-2026-65660 as allowing an authorized attacker to perform spoofing, with a CVSS score of 6.5, and assigns no impact to integrity or availability.
- [24]
The NVD score of 8.8 is 2.3 points higher than the 6.5 on Microsoft's advisory.
- [25]
The CVE record's remote code execution wording appeared 31 days after the patch shipped.
Sources
2 independent publishers whose own reporting we read for this story.
- thecyberexpress.comMicrosoft Upgrades SharePoint Flaw From Spoofing to 8.8 RCE
1 article · September 23, 2026
- thehackernews.comSharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
2 articles · September 22, 2026
Topics and entities
Topics
- Deserialization attacks
- SharePoint security
- Vulnerability severity scoring
Entities
- Microsoft
- CISA Known Exploited Vulnerabilities Catalog
- Dinh Ho Anh Khoa
- Microsoft SharePoint Server
- Viettel Cyber Security
- CVE-2026-55040
- National Vulnerability Database