CVE-2026-65660

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2016 Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition

Description Improper control of code generation in Microsoft Office SharePoint allows an authorized attacker with low-privileged credentials to execute arbitrary code over a network without user interaction. The issue resides in the ToolPane.GetPartPreviewAndPropertiesFromMarkup() function. An attacker can bypass SafeControls protection to register arbitrary .NET classes, achieving code execution through XamlServices.Parse() deserialization. This can lead to the creation of in-memory webshells, allowing the attacker to take control of the server in the context of the SharePoint farm account. Real-world exploitation was observed starting September 24, 2026, with confirmed webshell activity on September 25.

Recommendations Apply the Microsoft security updates released on August 11, 2026, for SharePoint Server 2016, 2019, and Subscription Edition. Restrict network access to the SharePoint server and review IIS logs for suspicious POST requests or unusual process spawns as a temporary mitigation.