KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-65660
8.8
3-Day Required
KEV
Active Exploitation
Details
VulnerabilityMicrosoft SharePoint Code Injection Vulnerability
VendorMicrosoft
ProductSharePoint
Date added2026-09-25
Due date2026-09-28
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-94
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
NVD: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-09-25 15:33 UTC
Wall time0.5s
Searches10
Component defaultyes (ToolPane.GetPartPreviewAndPropertiesFromMarkup is reachable by default in all vulnerable SharePoint Server versions; Microsoft disabled the method by default in the August 11, 2026 patch)
Sources
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/
https://nvd.nist.gov/vuln/detail/CVE-2026-65660
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
https://github.com/HORKimhab/CVE-2026-65660
https://learn.microsoft.com/en-us/sharepoint/administration/manage-anonymous-access-for-a-web-application
https://code-white.com/blog/exploiting-asp.net-templateparser-part-1
https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/
https://nvd.nist.gov/vuln/detail/CVE-2026-65660
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
https://github.com/HORKimhab/CVE-2026-65660
https://learn.microsoft.com/en-us/sharepoint/administration/manage-anonymous-access-for-a-web-application
https://code-white.com/blog/exploiting-asp.net-templateparser-part-1
QC notes
warn component_extraction: Component 'Microsoft.SharePoint.WebPartPages.ToolPane.GetPartPreviewAndPropertiesFromMarkup() — EditingPageParser.VerifyControlOnSafeList() SafeControls register-directive validation' matches or contains product name 'SharePoint' — no specific component identified
Hunting hypothesis agent
Hunt WAF request captures for quote-injected <%@ Register directives (ignoreParentFrozen, publishingribbon) in POSTs to /AddGallery.aspx exploiting ToolPane.GetPartPreviewAndPropertiesFromMarkup code injection in SharePoint.
Research details
ComponentMicrosoft.SharePoint.WebPartPages.ToolPane.GetPartPreviewAndPropertiesFromMarkup() — EditingPageParser.VerifyControlOnSafeList() SafeControls register-directive validation
PreconditionsUnpatched SharePoint Server 2016 (below 16.0.5565.1001), SharePoint Server 2019 (below 16.0.10417.20198), or Subscription Edition (below 16.0.19725.20522) as of the August 11, 2026 fix; the researcher also states SharePoint 2013 is affected. Network reachability to SharePoint web endpoints. Pre-auth only when the web application permits anonymous page viewing (common internet-facing setup); otherwise low-privileged authenticated access (CVSS PR:L). The ToolPane markup payload is POSTed to any WebPartPage-derived page containing a WebPartZone (observed at /_layouts/15/AddGallery.aspx, not ToolPane.aspx). agent
DeliveryNetwork HTTP POST of crafted WebPart/Control markup to any WebPartPage-derived endpoint containing a WebPartZone (e.g. /_layouts/15/AddGallery.aspx or ToolPane.aspx). The markup quote-injects a second <%@ Register directive that bypasses EditingPageParser.VerifyControlOnSafeList, loading ExpandedWrapper`2/XamlServices/ObjectDataProvider gadgets that deserialize a LosFormatter (ysoserial ActivitySurrogateSelectorGenerator) payload into an in-memory webshell; on farms with anonymous page viewing the request needs no credentials.
Public PoCno
Exploit notesNo runnable public exploit found this cycle: the only GitHub repo (HORKimhab/CVE-2026-65660) is a PDF mirror with a template README and no exploit code, so public_poc_exists stays 'no'. However Viettel Cyber Security published a detailed writeup with the complete exploit markup: quote-injected <%@ Register directives (Src attribute breaking out with double quotes, ignoreParentFrozen attribute, publishingribbon tagprefix auto-allowlisted by EditingPageParser.InitializeRegisterTable) resolve to System.Data.Services.Internal.ExpandedWrapper`2 + System.Xaml.XamlServices + ObjectDataProvider invoking LosFormatter (ysoserial ActivitySurrogateSelectorGenerator) for an in-memory webshell. Chaining with the ToolPane authentication gap (ToolPanePage calls SPUtility.EnsureAuthentication in OnInit, but ToolPane instantiated via WebPartPage.OnInit ToolPaneCreationAndInitialization skips it) yields pre-auth RCE on anonymous-enabled farms. CVSS attack complexity LOW (CVSS 8.8). The researcher states the technique was used in real-world operations. Stock IIS W3C access logs record only method/path/status — the payload lives in the POST body, so detection needs WAF/IDS request-body capture or a custom IIS log format.
SummaryMicrosoft SharePoint Server 2016, 2019, and Subscription Edition contain a code injection vulnerability (CVSS 8.8, CWE-94) in ToolPane.GetPartPreviewAndPropertiesFromMarkup, where quote injection through Microsoft.Web.Design.RegisterDirective.GetHtml lets an attacker smuggle a second <%@ Register directive past EditingPageParser.VerifyControlOnSafeList and reach XamlServices.Parse with a LosFormatter payload for an in-memory webshell. Viettel Cyber Security's writeup shows the ToolPane code path is reachable pre-auth on web applications that allow anonymous page viewing, and the researcher reports real-world use of the technique. Microsoft shipped the fix in the August 11, 2026 patch (which also disables the method by default); CISA added the CVE to KEV on September 25, 2026 with a September 28, 2026 remediation due date. No runnable public PoC repository was found — only a full technical writeup with payload markup.
Tia coverage
First reported2026-08-11
First exploit report2026-09-24
Exploit report → KEV1 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
cisa-adds-exploited-wso2-adobe-commerce-sharepoint-and-routeroscve-2026-5430-cvss-9-8-critical-jwt-auth-bypass-in-wso2-api-manatrois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.