Mislabelled SharePoint Bug Was Actually a Critical Remote Code Execution Flaw

A vulnerability in SharePoint Server, tracked as CVE-2026-65660, was initially described by Microsoft as a spoofing flaw with a moderate CVSS score of 6.5. New technical analysis from a Viettel Cyber Security researcher shows the flaw actually allows an authenticated attacker to execute code remotely, and the National Vulnerability Database now scores it 8.8, a near-critical rating. The mismatch between Microsoft's advisory and its own CVE record meant many defenders may have underestimated the risk when they first triaged this flaw.

The issue affects SharePoint Server 2016, 2019, and Subscription Edition. It stems from how SharePoint validates server-side controls against a safety list designed to block dangerous components from loading. An attacker who is already authenticated can exploit a flaw in how the system processes certain markup to register unauthorised classes and ultimately trigger code execution through a deserialization technique, according to the researcher's writeup.

Microsoft released patches for this vulnerability in its August 11 security updates, well before the full technical details and true severity were made public. The researcher behind this disclosure has a track record of finding serious SharePoint flaws, including the ToolShell exploit chain that was later used by state-backed hacking groups, and another authentication bypass bug that was exploited soon after details went public.