A significant discrepancy in the severity assessment of a **SharePoint Server** vulnerability has come to light. **Microsoft** initially categorized **CVE-2026-65660** as a spoofing flaw with a **CVSS** score of 6.5. However, comprehensive technical details released by **Dinh Ho Anh Khoa**, a researcher at **Viettel Cyber Security**, confirm that the flaw actually allows for authenticated remote code execution (RCE).  ### Impacted Versions and Patch Status The vulnerability affects **SharePoint Server 2016**, **2019**, and **Subscription Edition**. Patches for this flaw have been available since **Microsoft's** August 11 security updates. The **National Vulnerability Database** (NVD) now assigns **CVE-2026-65660** a significantly higher **CVSS** score of 8.8, reflecting its true RCE capabilities. ### The Discrepancy in Advisories **Microsoft's** official advisory for **CVE-2026-65660** describes it as a spoofing vulnerability, stating no impact on integrity or availability. In stark contrast, a separate **CVE** record published by **Microsoft** and updated on September 11, titles the same flaw as a remote code execution vulnerability, explicitly mentioning an authorized attacker's ability to execute code. Both records consistently assign **CWE-94**, a code-injection weakness. This inconsistency meant that many defenders, relying on the initial advisory, likely triaged **CVE-2026-65660** as a moderate spoofing issue, rather than a critical code-execution vulnerability with a near-maximum severity score. ### Researcher's Track Record **Dinh Ho Anh Khoa** is no stranger to uncovering critical **SharePoint** vulnerabilities. He previously demonstrated the **ToolShell** exploit chain against **SharePoint** at **Pwn2Own Berlin** in May 2025. That exploit chain was subsequently leveraged by Chinese state-backed groups, prompting urgent patches from **Microsoft**. Khoa has since disclosed several other **SharePoint** flaws, including **CVE-2026-55040**, an authentication bypass that saw active exploitation shortly after its details became public in August. ### Technical Deep Dive into CVE-2026-65660 The latest vulnerability, **CVE-2026-65660**, resides in how **SharePoint** verifies server-side controls against the **SafeControls** list – a mechanism designed to prevent the loading of dangerous classes. Specifically, when the **ToolPane** component processes web-part markup, it reconstructs **Register** directives by embedding attribute values within double quotes without properly escaping internal quotes.  This oversight allows an attacker to inject additional directives through unescaped quotes. By doing so, they can register arbitrary **.NET** classes after the type check has occurred but before the control is loaded. With the ability to load arbitrary classes, an attacker can then leverage `XamlServices.Parse()` to trigger code execution via deserialization. Khoa's write-up includes a functional in-memory webshell payload that bypasses common registry permission failures encountered with other deserialization methods. ### Chaining for Pre-Authentication RCE The researcher further demonstrated that **CVE-2026-65660** can be chained with a separate, previously patched authentication bypass to achieve pre-authentication remote code execution on servers configured to permit anonymous page access. Khoa notes that this bypass was addressed in a June 9 patch, and servers that have applied this fix are not vulnerable to the pre-authentication attack path. ### Exploitation Status and Recommendations Currently, there are no reported instances of **CVE-2026-65660** being exploited in the wild, and it is not listed in **CISA's Known Exploited Vulnerabilities** catalog. **Microsoft's** advisory rates exploitation as unlikely, despite the full exploit markup now being publicly available. Khoa has confirmed using the exploit in penetration testing engagements. The August 11 patch effectively remediates the flaw by fixing the vulnerability and disabling the affected function by default. It's also worth noting that Khoa states the flaw impacts **SharePoint 2013**, although **Microsoft's** advisory only lists **2016**, **2019**, and **Subscription Edition**. **SharePoint 2013** has been out of support since April 2023 and no longer receives security updates, leaving any remaining instances highly vulnerable.