Vulnerability severity ratings usually get a bit of debate at the margins - a CVSS 7.2 versus a 7.8, that kind of thing. CVE-2026-65660 is a stranger case: Microsoft's own security advisory classifies it as a spoofing vulnerability worth 6.5, while the CVE record Microsoft publishes for the same flaw calls it remote code execution and scores it 8.8. The Hacker News' write-up is blunt about which number should have driven patching decisions, and it wasn't the lower one.
A quoting bug in the component that renders web parts
The flaw lives in SharePoint's ToolPane component, the piece that processes web-part markup when a page loads. SharePoint is supposed to check every server-side control that gets instantiated against a SafeControls allowlist, a filter meant to stop untrusted classes from ever running. Per GBHackers' technical breakdown, ToolPane reconstructs a page's Register directives by writing attribute values between double quotes - without escaping quotes that appear inside those values. An attacker who controls part of that markup can inject their own quote characters, break out of the intended attribute, and register an arbitrary .NET class after the allowlist check has already run but before the control loads. The allowlist isn't bypassed so much as asked the wrong question at the wrong moment.
Why "spoofing" undersold it from the start
Patches for CVE-2026-65660 shipped quietly in Microsoft's 11 August security updates, filed under a severity rating that a lot of patch-triage processes would have queued behind anything scored as remote code execution that same month. The National Vulnerability Database disagreed with Microsoft's own advisory from the start, scoring it 8.8. The Canadian Centre for Cyber Security's alert AL26-023, issued 24 September, confirms active exploitation is underway - a day before CISA made the same call and added the CVE to its exploited-vulnerabilities catalog. Affected releases span SharePoint Enterprise Server 2016, Server 2019 and Server Subscription Edition; all three had fixes available six weeks before either agency's warning went out.
The chain that turns an authenticated bug into an anonymous one
CVE-2026-65660 requires a low-privileged authenticated session to trigger on its own, which is exactly the kind of caveat that lets a bug get deprioritised. That caveat stopped applying once researchers started watching it get used in the wild. Threat intelligence firm Previdian, cited in The Hacker News' reporting, has observed exploit attempts chaining CVE-2026-65660 with a separate, unpatched anonymous-delivery flaw in SharePoint to reach pre-authentication remote code execution on servers configured to permit anonymous access - no account, no password, no invitation needed. The observed chain drops an encrypted loader to establish persistent control of the server once it lands.
- Confirm every on-premises SharePoint Server instance is running the August 2026 security update or later - build numbers below 16.0.5565.1001 (2016), 16.0.10417.20198 (2019) or 16.0.19725.20522 (Subscription Edition) are exploitable.
- Audit anonymous access settings on any internet-facing SharePoint deployment; the observed attack chain specifically targets servers where anonymous access is permitted.
- Don't let a vendor's own severity label be the only input into patch prioritisation - cross-check it against the CVE record and, where they disagree, patch to the higher number.
- Hunt for unexpected .NET assemblies or newly registered server controls in SharePoint logs going back to mid-August, since exploitation may predate either government advisory.
SharePoint has had a rough 2026 - this is at least the third distinct on-premises SharePoint flaw we've covered this year, following the JWT-forgery chain used at Pwn2Own and the toolshell bug behind the DHS/HSIN breach. A pattern that consistent in one product is worth treating as a standing risk rather than a one-off patch cycle. Email sales@halfteck.com if you need help auditing exposure across on-premises collaboration platforms your teams patch on a slower cycle than they should.