Executive Summary: The Silent Elevation to Critical RCE

Enterprise IT administrators and incident response teams are contending with a critical escalation in threat activity targeting on-premises collaboration infrastructure. Tracked under identifier CVE-2026-65660, this vulnerability in Microsoft SharePoint Server allows authenticated network adversaries to bypass server-side control validation mechanisms and execute arbitrary code within the context of the Internet Information Services (IIS) worker process (w3wp.exe).

The flaw initially received a Common Vulnerability Scoring System (CVSS v3.1) base score of 6.5 and was classified by Microsoft as a "spoofing" vulnerability. However, subsequent independent security research and telemetry from live intrusions revealed that the underlying vulnerability enables unconstrained Code Injection (CWE-94). Microsoft revised the advisory, reclassifying the flaw as a high/critical Remote Code Execution (CVSS 8.8) vulnerability. Prompted by evidence of weaponization in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog.

The vulnerability impacts widespread enterprise deployments, encompassing Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Because SharePoint often sits at the nexus of corporate document repositories, intranet portals, and Active Directory authentication realms, successful exploitation provides an immediate staging ground for farm database exfiltration and Active Directory domain dominance.

Technical Deep-Dive: SafeControls Parser Breakdown & Type Smuggling

To understand the mechanics of CVE-2026-65660, one must analyze how SharePoint enforces the boundary between safe markup and arbitrary executable server code. In standard ASP.NET, web applications can dynamically parse markup files containing server tags (such as <asp:Label> or custom user controls). In a multi-tenant or multi-user environment like SharePoint, where users can create personal web pages, customize web parts, and upload templates, permitting arbitrary controls would result in trivial remote code execution.

To mitigate this risk, SharePoint implements a strict sandboxing layer known as SafeControls. Every SharePoint web application maintains a <SafeControls> section in its root web.config file that explicitly white-lists allowed assemblies, namespaces, and control types: 

<!-- Typical SharePoint SafeControls definition in web.config -->
<SafeControls>
  <SafeControl Assembly="Microsoft.SharePoint, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" 
               Namespace="Microsoft.SharePoint.WebControls" 
               TypeName="*" 
               Safe="True" 
               AllowRemoteDesigner="True" />
</SafeControls>

When an authenticated user requests a dynamic page or uploads a customized Web Part Definition (.dwp or .webpart), SharePoint's page parser (SPPageParserFilter and SafeModeFilter) inspects the AST (Abstract Syntax Tree) generated by the ASP.NET compilation engine. If a control type is encountered that is not listed with Safe="True", the parser throws an SPException ("A Web Part or Web Form Control on this Page cannot be displayed or imported") and terminates compilation.

The Parser Logic Vulnerability

The vulnerability in CVE-2026-65660 resides in the control resolution routines within Microsoft.SharePoint.ApplicationRuntime.SPParser. When processing nested, polymorphic control structures—specifically when property directives are wrapped in specific XML namespaces or dynamic template bindings—the parser fails to normalize type names before performing the SafeControls hash-table lookup.

Specifically:

  • Type Name Obfuscation: The parser strips certain formatting characters and trailing tokens after the safety validation check rather than before it. An attacker can craft a type descriptor with anomalous whitespace or character sequences that evaluates to a benign whitelisted string during the initial regex match, but later resolves to an arbitrary .NET class during assembly binding.
  • Dangerous Gadget Invocation: By smuggling non-safe types past the filter, the attacker instantiates gadget classes within the .NET runtime that expose dangerous initialization routines, such as System.Windows.Data.ObjectDataProvider or custom SharePoint workflow handlers that accept parameterized process invocation commands.
  • In-Memory Compilation: Once instantiated, the smuggled control executes within the application domain of the SharePoint web application, granting the adversary the exact privileges of the w3wp.exe identity (typically NT AUTHORITY\NETWORK SERVICE or a dedicated SharePoint Farm Service account).
# Architectural Flow of CVE-2026-65660 Weaponization:
[ Authenticated Adversary ] 
        │
        ▼ (Uploads crafted .webpart definition with smuggled type descriptor)
[ IIS Web Front End (WFE) : w3wp.exe ]
        │
        ├─► [ SPPageParserFilter / SafeModeFilter ]
        │         ├─ Checks raw type token against SafeControls whitelist
        │         └─ Sanitization bypass: Smuggled token matches whitelist rule
        │
        ├─► [ ASP.NET Compilation Engine: BuildManager ]
        │         ├─ Resolves true .NET Type via Reflection
        │         └─ Instantiates unapproved gadget class (CWE-94)
        │
        ▼
[ Arbitrary .NET Code Execution ]
        ├─ Spawns interactive payload under w3wp.exe
        ├─ Reads Farm Configuration DB credentials from web.config
        └─ Drops encrypted .ashx web shell into _layouts/15 directory

Exploitation Telemetry & Observed Post-Compromise Activity

Threat intelligence telemetry indicates that threat actors targeting CVE-2026-65660 leverage initial access acquired via low-privilege credentials (such as compromised domain user accounts, phished single-sign-on tokens, or contractor portal access). Because standard site contributors or document authors have sufficient privileges to customize personal web parts or edit wiki pages in team sites, low-privileged access is immediately weaponized for vertical privilege escalation.

In observed intrusions:

  1. Reconnaissance: Adversaries verify the exact build version of SharePoint by querying the HTTP response headers (MicrosoftSharePointTeamServices: 16.0.0.x) and verifying that the target farm is unpatched.
  2. Payload Delivery: The threat actor submits an HTTP POST request to the /_vti_bin/wps.asmx SOAP endpoint or the Web Part gallery page carrying an XML payload with the malformed SafeControl declaration.
  3. Web Shell Persistence: Once arbitrary code execution is achieved, attackers write a lightweight, memory-resident web shell into the SharePoint physical layouts path (typically C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\), bypassing antivirus file monitors by obfuscating the payload as an image or ASP.NET handler.
  4. Credential Harvesting: Attackers extract the farm database connection strings and machine keys from web.config, enabling them to decrypt farm secrets and execute queries directly against the Microsoft SQL Server back-end farm databases.

Defensive Playbook: Detection, Verification & Remediation

Remediating CVE-2026-65660 requires immediate patching followed by environmental verification and endpoint auditing across all SharePoint Farm servers.

1. Verify Farm Patch Level

Security teams should execute the following administrative PowerShell command on all SharePoint Central Administration and Web Front End (WFE) servers to confirm patch deployment: 

# Verify installed SharePoint Farm build versions across all servers
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

$farm = Get-SPFarm
Write-Host "[*] SharePoint Farm Build Version: " $farm.BuildVersion -ForegroundColor Cyan

# Inspect patch status of each server in the farm
Get-SPServer | ForEach-Object {
    $serverName = $_.Address
    Write-Host "[*] Auditing Server: $serverName" -ForegroundColor Yellow
    Get-SPProduct -Server $_.Name | Select-Object ProductName, PatchVersion
}

2. Inspect Web.Config SafeControls and Custom Assembly Entries

Audit the <SafeControls> elements across all virtual directory web.config files to detect rogue or wildcard (TypeName="*") entries that widen attack surfaces: 

# PowerShell script to audit web.config for wildcard SafeControls
$webConfigPaths = Get-ChildItem -Path "C:\inetpub\wwwroot\wss\VirtualDirectories" -Filter "web.config" -Recurse

foreach ($config in $webConfigPaths) {
    [xml]$xml = Get-Content $config.FullName
    $wildcards = $xml.configuration.'SharePoint/SafeMode'.SafeControls.SafeControl | Where-Object { $_.TypeName -eq "*" -and $_.Safe -eq "True" }
    if ($wildcards) {
        Write-Warning "[!] Found wildcard SafeControl entry in: $($config.FullName)"
        $wildcards | Format-Table Assembly, Namespace, TypeName, Safe
    }
}

3. Technical Vulnerability Specification

Parameter Vulnerability Specification Operational Risk Implication
CVE Identifier CVE-2026-65660 Active exploitation cataloged in CISA KEV
Vulnerability Class CWE-94 (Improper Control of Code Generation) SafeControls parser filter bypass enabling code injection
CVSS v3.1 Score 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Complete loss of confidentiality, integrity, and availability
Affected Platforms SharePoint Server 2016, 2019, Subscription Edition Widespread enterprise on-premises deployments
Mitigation Status Official Microsoft Security Updates Available Immediate patch deployment and post-patch farm config wizard run

Actionable Remediation Checklist

  • Deploy Vendor Patches: Apply the cumulative security updates released by Microsoft for SharePoint Server 2016, 2019, and Subscription Edition.
  • Execute PSConfig: After applying patches, ensure the SharePoint Products Configuration Wizard (psconfig.exe -cmd upgrade -inplace b2b -wait) is executed on all farm servers to finalize database schema updates.
  • Monitor IIS Worker Processes: Implement endpoint detection and response (EDR) rules to detect unusual child processes spawned by w3wp.exe (e.g., cmd.exe, powershell.exe, csc.exe).
  • Audit Web Shell Locations: Scan the _layouts and VirtualDirectories folders for newly created or modified .aspx, .ashx, or .asmx files with timestamps differing from base installations.