What happened
Security researchers have published full technical details showing that a SharePoint Server vulnerability Microsoft originally rated as a moderate "spoofing" issue is, in practice, a critical authenticated remote code execution (RCE) flaw. The bug, tracked as CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition, and carries an 8.8 severity score in the National Vulnerability Database — far above the 6.5 CVSS score in Microsoft's original spoofing advisory.
Microsoft has since updated the CVE record itself to describe it as a remote-code-execution vulnerability rather than spoofing, though the two records still don't fully agree on impact. Both classify the underlying weakness as CWE-94, a code-injection flaw.
How it works
The root cause sits in how SharePoint's ToolPane component processes web-part markup. When it reconstructs "Register" directives for server-side controls, it writes attribute values between quotes without properly escaping quote characters that appear inside them. That gap lets an attacker inject additional directives, registering arbitrary .NET classes after SharePoint's safety check (the "SafeControls" allow-list) has already run but before the control loads.
From there, an attacker can trigger code execution through .NET deserialization, using a technique that produces an in-memory web shell without touching the file system or registry — sidestepping the permission errors that typically block simpler deserialization attacks.
Researchers also showed the flaw can be chained with a separate, already-patched authentication bypass to achieve pre-authentication RCE on SharePoint servers configured to allow anonymous page access. That bypass was fixed in a June patch, so servers that applied it are not exposed to the pre-auth chain — but the disclosure still leaves a fully authenticated RCE path open on any unpatched system.
Why it matters
The mismatch between Microsoft's original "spoofing" classification and the flaw's actual impact matters because it shapes how defenders prioritize patching. A vulnerability advertised at 6.5 with "no impact to integrity or availability" competes for attention very differently than one capable of full code execution — and many organizations triage patches by advisory severity rather than re-deriving the risk themselves. Teams that deprioritized this update based on the initial rating may still be exposed.
The same research track record includes a prior SharePoint exploit chain that was later weaponized by state-linked threat actors and forced emergency out-of-band patches, which adds weight to this disclosure — even though there is no confirmed in-the-wild exploitation of this specific flaw yet, and it does not appear in CISA's Known Exploited Vulnerabilities catalog.
Worth noting: the flaw reportedly also affects SharePoint 2013, which has been out of support — and unpatched — since April 2023.
What to do
- Apply Microsoft's August security update if you haven't already; it fixes the flaw and disables the vulnerable function by default.
- Confirm the related June patch for the authentication bypass is also installed, especially on servers that allow anonymous page access.
- Don't rely on advisory severity labels alone — re-verify the actual impact of "spoofing" or "moderate" ratings against your own environment, particularly for internet-facing SharePoint deployments.
- If you're still running SharePoint 2013, treat it as unsupported and unpatchable; plan migration or additional compensating controls (network isolation, WAF rules) now.
- Review SharePoint server logs for anomalous ToolPane or web-part registration activity as a precaution, even without confirmed active exploitation.