Date: September 25, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Infrastructure / Zero-Day & RCE Analysis / Web Application Security
Tags: Microsoft SharePoint, CVE-2026-65660, CISA KEV, Remote Code Execution, EditingPageParser, Viettel Cyber Security, Windows Server
Executive Summary
On September 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent update to its Known Exploited Vulnerabilities (KEV) catalog, mandating that all federal civilian agencies and enterprise organizations remediate a critical vulnerability affecting Microsoft SharePoint Server tracked as CVE-2026-65660. As reported by BleepingComputer and The Hacker News, threat actors are actively exploiting exposed SharePoint instances in the wild to achieve unauthorized code execution and compromise internal enterprise document repositories.
The flaw has a fascinating and controversial history: Microsoft originally classified CVE-2026-65660 as a relatively benign "spoofing" vulnerability. However, an exhaustive technical analysis published by researcher khoadha of Viettel Cyber Security shattered that initial assessment, proving that the flaw is actually a high-severity Remote Code Execution (RCE) vulnerability rooted in an EditingPageParser type-check bypass.
Because Microsoft SharePoint Server operates as the primary collaboration backbone for Fortune 500 enterprises, defense organizations, and government agencies—housing terabytes of classified strategy documents, HR records, and financial plans—active exploitation represents an immediate threat to organizational confidentiality and network integrity. Under CISA’s Binding Operational Directive, federal agencies have been given an expedited deadline of September 28, 2026, to deploy vendor mitigations.
Technical Deep-Dive: From "Spoofing" to Remote Code Execution
To understand how a vulnerability originally labeled as "spoofing" translates into full system compromise, we must analyze SharePoint's internal page-parsing engine and ASP.NET compilation lifecycle.+-----------------------------------------------------------------------------------+
| CVE-2026-65660 SHAREPOINT RCE ATTACK ARCHITECTURE |
|---|+-----------------------------------------------------------------------------------+
Attacker (Authenticated / Anonymous Web Access)
|
| 1. Sends HTTP POST request containing crafted ASPX / Editing Page markup:
| Targeting `/_vti_bin/` or SharePoint Web Part Page endpoints
v
Microsoft SharePoint Web Application Worker (`w3wp.exe`)
|
| 2. Passes input to `EditingPageParser` class:
| - Intended to parse safe user-contributed web parts
| - Contains type-check bypass in directive validation routine!
|
| 3. [THE FLAW]: Malicious Object Type Bypass:
| - Parser fails to enforce strict type-safety on custom server controls!
| - Attacker forces compilation of arbitrary server-side directives!
v
ASP.NET Dynamic Page Compiler (`System.Web.Compilation`)
|
| 4. Compiles attacker-injected C# code into temporary DLL on disk:
| `C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\`
v
[In-Memory Code Detonation]
|
| 5. Spawns Interactive Shell / Web Shell under SharePoint AppPool Identity!
| Permissions: `IIS APPPOOL\SharePoint - 80` or High-Privilege Domain Service
v
Full Compromise of Enterprise Document Vault:
- Dumps SharePoint Content Databases (SQL Server)
- Exfiltrates Internal Intranet Files & Encryption Keys (MachineKeys)
- Pivots laterally across corporate Active Directory domain!
1. The Root Cause: The EditingPageParser Type-Check Flaw
Microsoft SharePoint allows users to customize web pages through rich web parts and dynamic layouts. To ensure security, SharePoint restricts page authors from embedding arbitrary ASP.NET server-side code (such as <% ... %> script tags) unless the page resides in a trusted directory and is compiled in an administrator-approved mode.
When a page is submitted for rendering or preview:
1. SharePoint invokes the EditingPageParser class within Microsoft.SharePoint.dll.
2. The parser is responsible for validating that all controls, tags, and object types declared within the markup match a strict, pre-approved safelist.
3. Researcher khoadha discovered that by structuring a request with nested custom control definitions and abusing a flaw in how the parser handles type-casting during object validation, an attacker can bypass the type-checking gatekeeper.
4. The parser incorrectly concludes that an untrusted, user-supplied control is a safe built-in component, passing the raw markup to the underlying ASP.NET page compiler.
2. The Compilation Chain: From Markup to DLL Execution
Once the type-check is subverted:
* The ASP.NET compilation engine (System.Web.Compilation.BuildManager) compiles the injected markup into a native .NET assembly.
* The compiled DLL is saved into the temporary ASP.NET files cache and executed dynamically by the worker process (w3wp.exe).
* The attacker's embedded C# code detonates in memory, giving the attacker arbitrary command execution on the host Windows Server.
3. Misclassification and the Weaponization Gap
Because Microsoft originally documented CVE-2026-65660 as a spoofing vulnerability with a lower CVSS score, many enterprise patch management teams deprioritized deployment of the August/September security updates. Threat actors capitalized on this "weaponization gap"—reconstructing the exploit following public diffing of SharePoint binary changes and launching automated scanning campaigns targeting exposed enterprise servers.
Affected Products and Firmware Versions
The vulnerability impacts on-premises deployments of Microsoft SharePoint Server across multiple release branches:
Product Name
Vulnerability Status
Patched Build / Update
Microsoft SharePoint Server 2016
Vulnerable prior to security update
Apply August/September 2026 Security Update
Microsoft SharePoint Server 2019
Vulnerable prior to security update
Apply August/September 2026 Security Update
Microsoft SharePoint Server Subscription Edition
Vulnerable prior to security update
Apply August/September 2026 Security Update
Note: Microsoft 365 / SharePoint Online cloud environments have already received backend service-side mitigations and are not vulnerable.
Strategic Blast Radius: Why SharePoint Is a Tier-One Target
A successful compromise of an enterprise SharePoint server causes severe cascading damage across corporate networks:
1. Mass Theft of Unstructured Data: SharePoint is the primary repository for enterprise data lakes. Attackers gain direct filesystem and SQL access to unencrypted PDFs, Word documents, Excel financial models, and strategic communications.
2. MachineKey Theft & Token Forgery: Once inside w3wp.exe, adversaries dump the ASP.NET machineKey values stored in SharePoint's web.config. With these cryptographic keys, an attacker can forge valid viewstate payloads and session authentication cookies, guaranteeing persistent access even after subsequent server reboots.
3. Lateral Movement Bridgehead: SharePoint servers are typically joined to corporate Active Directory domains and communicate directly with backend Microsoft SQL Server clusters over authenticated service accounts. Threat actors regularly harvest Kerberos tickets (Kerberoasting) or extract cached service account credentials to escalate privileges to Domain Admin.
Incident Response & Hardening Playbook
Enterprise systems administrators managing on-premises SharePoint farms must immediately execute the following defensive protocols:
1. Apply Official Microsoft Security Updates Immediately
* Download and apply the official security updates for your specific SharePoint Server edition.
* Run the SharePoint Products Configuration Wizard (psconfig): Installing the update binary is not sufficient. Administrators must run the configuration wizard on every server in the farm to update the SharePoint database schemas:
psconfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures
2. Sever Public Internet Exposure
* Enforce VPN / Zero-Trust Network Access (ZTNA): On-premises SharePoint servers should never be exposed directly to the public internet. Restrict all ingress traffic exclusively to authenticated corporate VPNs or Cloudflare/Zscaler ZTNA connectors.
* Block External Ingress to Diagnostic APIs: If SharePoint must be accessible to remote users, place an enterprise Web Application Firewall (WAF) in front of the farm and block access to unneeded administrative endpoints (/_vti_bin/, /_layouts/).
3. Conduct Compromise Assessment and Threat Hunting
Perform an immediate retrospective inspection across server event logs and filesystems:
* Inspect Temporary ASP.NET Directories: Audit files created within C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\ over the past 30 days for anomalous C# compilation artifacts or newly generated DLLs with irregular timestamps.
* Review IIS Web Logs: Search W3C access logs for HTTP POST requests to /_vti_bin/ or .aspx pages resulting in HTTP 200/500 codes originating from unfamiliar or anonymized IP addresses.
* Monitor Process Lineage: Configure EDR rules to alert whenever w3wp.exe (where the command line contains -ap "SharePoint") spawns child processes such as cmd.exe, powershell.exe, csc.exe, or certutil.exe.
Conclusion
The addition of CVE-2026-65660 to the CISA KEV catalog confirms that threat actors are aggressively harvesting enterprise SharePoint servers. The journey of this flaw from a misclassified "spoofing" bug to an actively exploited remote code execution vector serves as an urgent reminder: enterprise patch management cannot rely solely on vendor-supplied risk labels. Organizations must immediately deploy the necessary updates, isolate SharePoint from public internet exposure, and hunt for signs of prior compromise.
For detailed threat intelligence briefings and enterprise defense research, visit Digital Spying.