Wisevoter
World

Microsoft SharePoint Security Flaw Severity Upgraded

The National Vulnerability Database raised the severity of a code execution bug originally downplayed by Microsoft.

Updated on Sept. 22, 2026 in Cybersecurity

Isometric editorial illustration of a single metallic server rack module, representing technical infrastructure vulnerability.
The National Vulnerability Database has increased the severity rating for a remote code execution vulnerability found in Microsoft SharePoint Server. AI Illustration. Upload story photo >

Live Poll

Do you trust major technology companies to accurately disclose the severity of software security flaws?

Security researcher Dinh Ho Anh Khoa identified an authenticated remote code execution vulnerability in SharePoint Server now tracked as CVE-2026-65660. The flaw allows attackers to register arbitrary .NET classes to trigger code execution.

Why it matters

The upgrade reflects a critical discrepancy between the initial manufacturer assessment and the findings of the National Vulnerability Database. This vulnerability exploits how SharePoint validates server-side controls, posing a significant risk if left unpatched.

The vulnerability involves a CWE-94 code-injection weakness affecting SharePoint Server 2016, 2019, and the Subscription Edition. While Microsoft originally rated the flaw as a spoofing issue with a 6.5 CVSS score, the NVD assigned it a high 8.8.

The players

Dinh Ho Anh Khoa

He is the security researcher who identified the remote code execution vulnerability in SharePoint Server.

Microsoft

This global technology corporation develops the SharePoint platform and maintains the security updates for its server products.

National Vulnerability Database

Operated by the U.S. government, this repository provides standardized vulnerability management data to the cybersecurity community.

The details

The flaw exists within the ToolPane component, which fails to properly sanitize attribute values during the reconstruction of Register directives. By injecting unescaped quotes, an attacker can manipulate the system into loading arbitrary classes through deserialization.

Timeline

  1. April 2023: SharePoint 2013 support concluded.

  2. May 2025: ToolShell exploit chain was demonstrated at Pwn2Own in Berlin.

  3. June 9, 2026: An authentication bypass patch was released.

  4. August 11, 2026: Official security updates for the flaw were deployed.

  5. September 11, 2026: Microsoft updated the official CVE record to reflect the RCE classification.

Roadmap

The vulnerability follows a pattern established by the Pwn2Own exploit competition where advanced chains are tested against enterprise software. This discovery highlights the ongoing challenge of securing complex, legacy-integrated server environments against modern injection techniques.

Organizations relying on SharePoint Server must ensure that all systems are updated to the patches released in August 2026 to mitigate code injection risks. Administrators should verify that the specific versions covered by the security update are fully patched to prevent unauthorized .NET class loading.

The takeaway

Maintaining up-to-date server software is critical, as even vulnerabilities initially classified as minor can be re-evaluated as high-risk execution flaws. Always prioritize patching enterprise platforms like SharePoint to defend against potential deserialization attacks.

Further reading

Learn more about securing enterprise server environments in the Cybersecurity section.

Live Poll

Do you trust major technology companies to accurately disclose the severity of software security flaws?