# CVE-2026-65660: Code Injection (ToolPane SafeControls Bypass) in Microsoft SharePoint Server Under Active Exploitation

> CVE-2026-65660 is a code injection flaw (CWE-94) in the ToolPane component of on-premises Microsoft SharePoint Server 2016, 2019 and Subscription Edition that lets a low-privileged authenticated user execute code over the network. A public technical write-up appeared on 2026-09-22, exploitation attempts were observed from 2026-09-24, and CISA added it to KEV on 2026-09-25.

- **Published:** 2026-10-16T21:14:14Z
- **Last reviewed:** 2026-10-16T21:14:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3777
- **ID:** TL-2026-3777
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65660

## Description

CVE-2026-65660 stems from how SharePoint processes web parts. When the ToolPane component handles web-part markup, it reconstructs Register directives by writing attribute values between double quotes without escaping embedded quotes. An attacker can therefore inject additional directives after SafeControls validation has run and cause arbitrary .NET classes that were never approved by SafeControls to load. Public analysis describes using XamlServices.Parse() to reach deserialization-based code execution and to deploy an in-memory webshell that avoids file-based detection.

The flaw requires a valid low-privileged SharePoint account, no user interaction, and is network-reachable. Reporting states it chains with a separate anonymous-delivery/authentication-bypass weakness (patched 2026-06-09) to give pre-authentication remote code execution on servers configured to permit anonymous page access. Microsoft released fixes on 2026-08-11, the CVE was published 2026-08-13 as a medium-severity (6.5) spoofing issue, and it was reclassified as RCE with CVSS 8.8 (NVD) in September 2026. SharePoint Online is not listed as affected. SharePoint 2013 is reportedly also affected but has been unsupported since April 2023, and SharePoint 2016/2019 reached end of life on 2026-07-15 per the Canadian Cyber Centre.

The issue is credited to Dinh Ho Anh Khoa of Viettel Cyber Security, who previously demonstrated the ToolShell chain at Pwn2Own Berlin (May 2025). A full technical write-up was published 2026-09-22. Previdian, a threat-intelligence vendor running a SharePoint honeypot, recorded 12 requests from 169.150.248.21 on 2026-09-24 in a two-stage attempt, and webshell creation attempts on 2026-09-25. By 2026-09-28 it had tracked 16 attempts from two sources. The captured requests carried no authentication headers or cookies, consistent with the anonymous-delivery chain. They targeted /_layouts/15/AddGallery.aspx and /_layouts/15/designgallery.aspx with job=all&DisplayMode=Edit and the form fields MSOTlPn_Uri and MSOTlPn_DWP. Each path received a paired payload of 7,834 and 535,404 bytes using the ActivitySurrogateDisableTypeCheck and ActivitySurrogate gadgets. These embed an assembly loader named SdLoader (DLL wt3k3sij.dll) that uses AES decryption and Assembly.Load(byte[]) for in-memory execution, and a webshell was staged at /_layouts/15/sphealth.aspx.

Patching closes the vulnerability but does not remove webshells or persistence installed earlier. No threat actor attribution has been published and no universal IOC set exists, so webshell and ToolPane request telemetry should be treated as hunting leads rather than definitive proof of compromise.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1505.003 Server Software Component: Web Shell
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information

## Sources

- [CVE 2026 65660 en Microsoft SharePoint (Cronup)](https://www.cronup.com/cve-2026-65660-en-microsoft-sharepoint/)
- [Microsoft SharePoint CVE-2026-65660 Exploited in Attacks as CISA Deadline Hits (eSecurity Planet)](https://www.esecurityplanet.com/cybersecurity-threats/news-sharepoint-cve-2026-65660-active-exploitation)
- [Canadian Cyber Centre Alert AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660](https://cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660)
- [SharePoint Vulnerability Exploited (Field Effect)](https://fieldeffect.com/blog/sharepoint-vulnerability-exploited)
- [SharePoint Flaw Initially Listed as Spoofing (The Hacker News)](https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html)
- [CVE-2026-65660 SharePoint RCE Moves From Disclosure to Active Exploitation in Days (breached.company)](https://breached.company/cve-2026-65660-sharepoint-rce-moves-disclosure-active-exploitation-days/)
- [MSRC CSAF advisory for CVE-2026-65660](https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-65660.json)
- [NVD - CVE-2026-65660](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-65660)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-65660 added 2026-09-25)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [SentinelOne Vulnerability Database - CVE-2026-65660](https://www.sentinelone.com/vulnerability-database/cve-2026-65660/)
- [SOCRadar CVE Radar - CVE-2026-65660](https://socradar.io/free-tools/cve-radar/CVE-2026-65660)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3777