SharePoint Vulnerability Upgraded to RCE Status
Microsoft has elevated the severity of a SharePoint flaw after researchers identified a path to remote code execution.
Updated on Sept. 22, 2026 in Cybersecurity
Live Poll
Do you trust major technology companies to accurately disclose the severity of software security flaws?
Microsoft recently updated its classification of CVE-2026-65660 from a spoofing vulnerability to an authenticated remote code execution (RCE) flaw. The security issue affects several versions of SharePoint Server, including the 2016, 2019, and Subscription Editions.
Why it matters
The reclassification acknowledges that attackers can execute arbitrary code rather than merely bypassing authentication, fundamentally changing the risk profile for enterprise deployments. This update follows a critical review of how the platform validates server-side controls against its existing security list.
The vulnerability carries a CVSS score of 8.8, a significant increase from the initial Microsoft rating of 6.5. It affects SharePoint Server 2016, 2019, and the Subscription Edition, while SharePoint 2013 remains affected despite having reached the end of its support lifecycle.
The players
Dinh Ho Anh Khoa
Security researcher who identified the remote code execution vulnerability.
Microsoft
Software giant responsible for the SharePoint ecosystem and its underlying .NET integration.
The details
The vulnerability stems from a CWE-94 code-injection weakness within the ToolPane component, which fails to properly sanitize attribute values during the reconstruction of Register directives. By injecting unescaped quotes, an attacker can manipulate this process to register arbitrary .NET classes. This bypasses the system's SafeControls list, allowing the execution of unauthorized code via deserialization.
Timeline
April 2023: SharePoint 2013 support concluded.
May 2025: ToolShell exploit chain was demonstrated at Pwn2Own in Berlin.
June 9, 2026: An authentication bypass patch was released.
August 11, 2026: Microsoft issued security updates for CVE-2026-65660.
September 11, 2026: The vulnerability record was updated to include RCE classification.
The Tech Race
This reclassification follows the security patterns observed during the ToolShell exploit chain demonstrated at Pwn2Own. It highlights an ongoing struggle to secure enterprise platforms against complex injection attacks that bypass traditional controls.
Administrators managing SharePoint 2016, 2019, or Subscription Edition should ensure that the security updates released on August 11, 2026, are fully applied. Organizations using the unsupported SharePoint 2013 platform remain exposed to this vulnerability and must consider migration as the primary remediation.
The takeaway
The move to RCE classification confirms that the vulnerability is more severe than previously estimated by the vendor. Security teams should prioritize patching across all supported SharePoint instances to mitigate the risk of arbitrary code execution.
Further reading
For more information on securing enterprise software, see our Cybersecurity section.
Live Poll
Do you trust major technology companies to accurately disclose the severity of software security flaws?
