Date: September 25, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Infrastructure / Zero-Day Vulnerability / Web Application Exploitation
Tags: Microsoft SharePoint, CVE-2026-65660, SafeControls Bypass, Code Injection, Remote Code Execution, CISA KEV, IIS
Executive Summary
On September 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive adding CVE-2026-65660 to its Known Exploited Vulnerabilities (KEV) catalog following confirmed in-the-wild exploitation against enterprise and government networks. As detailed by CISA Alerts, The Hacker News, Viettel Cyber Security, and Redmond Magazine, the vulnerability represents a critical code injection flaw impacting on-premises installations of Microsoft SharePoint Server (Subscription Edition, 2019, and 2016).
The vulnerability holds particular notoriety because it was initially misclassified by Microsoft as a lower-severity "Spoofing" vulnerability. However, subsequent vulnerability research demonstrated that CVE-2026-65660 fundamentally shatters SharePoint’s primary security boundary: the SafeControls allowlist.
By subverting ASP.NET type-validation routines during dynamic page parsing and Web Part rendering, threat actors can bypass safe-mode execution and achieve arbitrary Remote Code Execution (RCE) within the Internet Information Services (IIS) worker process (w3wp.exe). Armed with code execution on an internal SharePoint server, adversaries can harvest cryptographic farm machine keys, dump confidential document repositories, and pivot across Active Directory domains.
Technical Deep-Dive: Breaking the SafeControls Sandbox
To understand the mechanics of CVE-2026-65660, we examine SharePoint's server-side control parsing architecture and how SafeControls enforces sandboxed ASPX execution.+-----------------------------------------------------------------------------------+
| CVE-2026-65660 EXPLOIT ATTACK CHAIN |
|---|
Remote Attacker Microsoft SharePoint Server (IIS / w3wp.exe)
| |
| 1. Dispatches crafted ASPX / Web Part payload containing |
| specially structured generic type arguments in server control: |
| ` | Type="System.Web.UI.TemplateControl, ... |--------------------------------------------------------------------->| | | | | 2. `SafeControlsValidator` inspects: | | - Evaluates outer type against | | `web.config` SafeControls list | | - [SECURITY FLAW] Fails to parse | | nested/generic type parameters! | | - Erroneously approves control as "SAFE"! | | | | 3. ASP.NET Dynamic Compilation triggers: | | - `w3wp.exe` resolves generic types | | - Instantiates unsafe gadget object | | - Evaluates malicious expressions | | | | 4. Arbitrary C# Code Executed: | | Launches payload within worker process! | |<----------------------------------------- | | | 5. Interactive Reverse Shell established under IIS Application Pool | | identity (e.g. `c担任/spapppool` or `NT AUTHORITY\SYSTEM`) | |<=====================================================================| v v Full SharePoint Server Takeover -> MachineKey Extraction -> Site-Wide Cookie Forgery! 1. The Core Sandbox: How SafeControls Works In Microsoft SharePoint, users with editing or document-upload privileges can customize pages and upload Web Parts. Because ASP.NET pages (.aspx) are compiled into executable C# assemblies on the fly, SharePoint implements a strict sandbox: * The application’s web.config maintains a list of * When a page is requested, SharePoint’s internal filter (SPPageContentFilter and SafeControlsValidator) parses the AST (Abstract Syntax Tree) of the page to ensure that no unauthorized controls or unsafe server-side types are present. * If an unauthorized class is detected, the page compilation is aborted with a security exception. 2. The Root Cause: Generic Type Parameter Validation Blindspot Vulnerability research published by Viettel Cyber Security revealed that the validator contains a fatal parsing flaw when handling complex, generic .NET types: * The validator inspects the primary type definition against the SafeControls whitelist. * However, when a control declares nested generic arguments (e.g., System.Collections.Generic.List * As long as the root generic container matches a registered safe control, the entire control passes inspection. 3. Exploitation & Memory Code Execution 1. Crafting the Gadget Payload: The attacker constructs an ASPX page or modifies a personal site page containing a Web Part that encapsulates a dangerous .NET gadget chain within an allowable generic wrapper. 2. Bypassing the Gatekeeper: The SharePoint engine verifies the outer control against web.config and marks the markup as safe for dynamic compilation. 3. Triggering Dynamic Compilation: During page generation, ASP.NET’s Roslyn/CodeDom compiler evaluates the embedded expressions, instantiating the unsafe object. 4. Shellcode Execution: The object’s constructor or property setter invokes arbitrary C# methods, executing native shellcode or spawning command processes (cmd.exe, powershell.exe) directly inside the IIS worker process. 4. Post-Exploitation Blast Radius: Harvesting the machineKey Compromising a SharePoint server provides attackers with an immediate pathway to domain-level dominance: * MachineKey Extraction: The attacker reads the IIS configuration to extract the static machineKey (ValidationKey and DecryptionKey) shared across the entire SharePoint farm. * Forging ViewState Tokens: Possessing the machineKey allows threat actors to forge valid ASP.NET ViewState payloads, enabling unauthenticated remote code execution on every other server in the SharePoint farm. * Document Vault Theft: Attackers gain direct, unencrypted read access to the underlying Microsoft SQL Server database (WSS_Content), exfiltrating all organizational files, intranet secrets, and internal wikis. Defensive Hardening & Enterprise Remediation Blueprint Because CVE-2026-65660 is actively weaponized in real-world intrusion campaigns, organizations operating on-premises SharePoint farms must execute immediate containment and patching: 1. Deploy Official Microsoft Security Updates (Primary Fix) Ensure that all servers in the SharePoint farm (front-end web servers, application servers, and search nodes) have installed the latest cumulative security update: * SharePoint Server Subscription Edition: Install latest cumulative update (CU). * SharePoint Server 2019 / 2016: Apply security release packages immediately. * CRITICAL STEP: Run the SharePoint Products Configuration Wizard (psconfig): Installing the update files alone does not update the SharePoint database schema or bin assemblies. Administrators must execute:PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures 2. Enable Antimalware Scan Interface (AMSI) for SharePoint Ensure that AMSI is active on all SharePoint IIS web applications. AMSI intercepts dynamically compiled ASPX scripts and evaluates in-memory content against your endpoint protection engine (Microsoft Defender for Endpoint):# Verify AMSI integration status in SharePoint Get-SPWebApplication | Select-Object DisplayName, EnableAmsi 3. Restrict Network Exposure & Disable Anonymous Access * Sever External Exposure: SharePoint on-premises management and collaboration portals should never be exposed directly to the public internet without an authenticating reverse proxy or VPN. * Disable Anonymous Uploads: Verify that anonymous access is completely disabled on all SharePoint web applications to prevent unauthenticated payload staging. 4. Threat Hunting & SOC Detection Playbook Security operations centers should deploy the following detection queries across endpoint telemetry (Sysmon / MDE): * Anomalous Process Lineage (Sysmon Event ID 1): Alert on IIS worker process (w3wp.exe) spawning interactive command shells:ParentImage: "C:\\Windows\\System32\\inetsrv\\w3wp.exe" Image: - "C:\\Windows\\System32\\cmd.exe" - "C:\\Windows\\System32\\powershell.exe" - "C:\\Windows\\System32\\whoami.exe" * Suspicious ASPX Modifications: Monitor for new or modified .aspx files within SharePoint virtual directories (C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\):Get-ChildItem -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\" -Filter "*.aspx" -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} For technical vulnerability breakdowns, zero-day threat analysis, and enterprise infrastructure security research, follow Digital Spying.