Threat reportVulnerabilityTL-2026-3777
CVE-2026-65660: Code Injection (ToolPane SafeControls Bypass) in Microsoft SharePoint Server Under Active Exploitation
CVE-2026-65660 (TL-2026-3777) is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-10-16. It has no confirmed attribution, affects Microsoft SharePoint Server Subscription Edition, references 1 CVE (CVE-2026-65660), maps to 6 MITRE ATT&CK techniques (T1027, T1078, T1140), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 8.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3777
- Threat ID
- TL-2026-3777
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in CVE-2026-65660
Malware and tooling: SdLoader
How CVE-2026-65660 works
CVE-2026-65660 is a code injection flaw (CWE-94) in the ToolPane component of on-premises Microsoft SharePoint Server 2016, 2019 and Subscription Edition that lets a low-privileged authenticated user execute code over the network. A public technical write-up appeared on 2026-09-22, exploitation attempts were observed from 2026-09-24, and CISA added it to KEV on 2026-09-25.
CVE-2026-65660 stems from how SharePoint processes web parts. When the ToolPane component handles web-part markup, it reconstructs Register directives by writing attribute values between double quotes without escaping embedded quotes. An attacker can therefore inject additional directives after SafeControls validation has run and cause arbitrary .NET classes that were never approved by SafeControls to load. Public analysis describes using XamlServices.Parse() to reach deserialization-based code execution and to deploy an in-memory webshell that avoids file-based detection.
The flaw requires a valid low-privileged SharePoint account, no user interaction, and is network-reachable. Reporting states it chains with a separate anonymous-delivery/authentication-bypass weakness (patched 2026-06-09) to give pre-authentication remote code execution on servers configured to permit anonymous page access. Microsoft released fixes on 2026-08-11, the CVE was published 2026-08-13 as a medium-severity (6.5) spoofing issue, and it was reclassified as RCE with CVSS 8.8 (NVD) in September 2026. SharePoint Online is not listed as affected. SharePoint 2013 is reportedly also affected but has been unsupported since April 2023, and SharePoint 2016/2019 reached end of life on 2026-07-15 per the Canadian Cyber Centre.
The issue is credited to Dinh Ho Anh Khoa of Viettel Cyber Security, who previously demonstrated the ToolShell chain at Pwn2Own Berlin (May 2025). A full technical write-up was published 2026-09-22. Previdian, a threat-intelligence vendor running a SharePoint honeypot, recorded 12 requests from 169.150.248.21 on 2026-09-24 in a two-stage attempt, and webshell creation attempts on 2026-09-25. By 2026-09-28 it had tracked 16 attempts from two sources. The captured requests carried no authentication headers or cookies, consistent with the anonymous-delivery chain. They targeted /_layouts/15/AddGallery.aspx and /_layouts/15/designgallery.aspx with job=all&DisplayMode=Edit and the form fields MSOTlPn_Uri and MSOTlPn_DWP. Each path received a paired payload of 7,834 and 535,404 bytes using the ActivitySurrogateDisableTypeCheck and ActivitySurrogate gadgets. These embed an assembly loader named SdLoader (DLL wt3k3sij.dll) that uses AES decryption and Assembly.Load(byte[]) for in-memory execution, and a webshell was staged at /_layouts/15/sphealth.aspx.
Patching closes the vulnerability but does not remove webshells or persistence installed earlier. No threat actor attribution has been published and no universal IOC set exists, so webshell and ToolPane request telemetry should be treated as hunting leads rather than definitive proof of compromise.
MITRE ATT&CK techniques used in TL-2026-3777
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
Affected products and versions in CVE-2026-65660
- Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: < 16.0.19725.20522
Fixed in: 16.0.19725.20522 (KB5002893) - Microsoft — SharePoint Server 2019
Vulnerable versions: < 16.0.10417.20198
Fixed in: 16.0.10417.20198 (KB5002894, KB5002896) - Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: < 16.0.5565.1001
Fixed in: 16.0.5565.1001 (KB5002905, KB5002906)
Remediation for CVE-2026-65660
Patches
- SharePoint Server Subscription Edition: KB5002893, fixed build 16.0.19725.20522
- SharePoint Server 2019: KB5002894 and KB5002896, fixed build 16.0.10417.20198
- SharePoint Enterprise Server 2016: KB5002905 and KB5002906, fixed build 16.0.5565.1001
Immediate actions
- Apply the 2026-08-11 SharePoint security update on every farm node and verify the fixed build per node, not only in Central Administration
- Verify the 2026-06-09 security update (anonymous-delivery / authentication-bypass fix) is also installed
- Preserve forensic evidence and hunt retrospectively for webshells (e.g. /_layouts/15/sphealth.aspx) and anomalous ToolPane requests before and after patching
- Restrict or disable anonymous access to SharePoint sites and pages
Workarounds
- Limit internet exposure via VPN or authenticated reverse proxy
- Monitor w3wp.exe child processes, PowerShell execution and memory-resident activity
- Monitor SharePoint, IIS, endpoint and authentication logs for web part modifications and authentication anomalies
Longer-term hardening
- Avoid direct internet exposure of SharePoint; place a Layer 7 reverse proxy requiring authentication in front
- Enable AMSI integration in Full Mode with full request-body scanning where feasible
- Restrict Central Administration access, remove inactive accounts, enforce MFA for administrators
- Review low-privilege account provisioning and permissions
- Migrate off end-of-life SharePoint 2016/2019 to Subscription Edition
CVEs associated with CVE-2026-65660
Weaknesses (CWE) in CVE-2026-65660
Timeline of CVE-2026-65660
- Microsoft patches the separate anonymous-delivery / authentication-bypass weakness that is later chained with CVE-2026-65660 for pre-auth RCE
- Microsoft releases security updates for SharePoint 2016, 2019 and Subscription Edition; vulnerable function disabled by default
- CVE-2026-65660 published, initially rated CVSS 6.5 as a medium-severity spoofing vulnerability
- CVE record updated to reflect code execution; NVD scores it CVSS 8.8 (CWE-94). Another source dates the RCE reclassification to 2026-08-27
- Full technical write-up / proof of concept published by Viettel Cyber Security researcher Dinh Ho Anh Khoa
- Previdian honeypot records 12 requests from 169.150.248.21 in a two-stage exploitation attempt; Canadian Cyber Centre issues alert AL26-023
- CISA adds CVE-2026-65660 to the KEV catalog; webshell creation attempts observed; Microsoft confirms exploitation
- CISA BOD 26-04 federal remediation deadline; Previdian reports 16 attempts from two sources by this date
- Cronup publishes coverage of the actively exploited flaw, reiterating that patching does not remove installed webshells
Sources cited for CVE-2026-65660
- CVE 2026 65660 en Microsoft SharePoint (Cronup)
- Microsoft SharePoint CVE-2026-65660 Exploited in Attacks as CISA Deadline Hits (eSecurity Planet)
- Canadian Cyber Centre Alert AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
- SharePoint Vulnerability Exploited (Field Effect)
- SharePoint Flaw Initially Listed as Spoofing (The Hacker News)
- CVE-2026-65660 SharePoint RCE Moves From Disclosure to Active Exploitation in Days (breached.company)
- MSRC CSAF advisory for CVE-2026-65660
- NVD - CVE-2026-65660
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-65660 added 2026-09-25)
- SentinelOne Vulnerability Database - CVE-2026-65660
- SOCRadar CVE Radar - CVE-2026-65660
Detection coverage for TL-2026-3777
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3777 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.