CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
Overview
Microsoft SharePoint contains a code injection flaw in its SafeControls processing that allows an authenticated attacker with low-level access to execute arbitrary code on the server. By sending crafted POST requests with malicious form field values to SharePoint layout pages, an attacker can bypass .NET control validation, reach attacker-controlled deserialization, and load arbitrary assemblies. Affected versions span SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition. Active exploitation has been observed, including attempts to chain this flaw with a separate anonymous delivery bug to achieve pre-authentication code execution on sites permitting anonymous viewing.
Vulnerability details
CWE-94 (code injection) describes a condition where attacker-supplied input reaches a code-generation or code-loading pathway without adequate sanitization. In SharePoint, the SafeControls mechanism is intended to validate which .NET controls are permitted to load. A quote-injection flaw in that validation path allows crafted input to escape the control boundary, bypassing the safeguard and reaching a deserialization routine that accepts attacker-controlled content. Because the flaw sits in ToolPane processing invoked through layout pages such as AddGallery.aspx and designgallery.aspx, it is reachable over the network by any user who can authenticate to the SharePoint site.
An attacker sends two sequential POST requests to SharePoint layout pages, targeting the MSOTlPn_Uri and MSOTlPn_DWP form fields with the DisplayMode=Edit query parameter. The first, smaller payload disables a .NET deserialization safeguard; the second carries a loader that decrypts and executes an embedded assembly. Successful exploitation yields remote code execution on the SharePoint server and, as observed in the wild, deployment of a persistent webshell at /_layouts/15/sphealth.aspx along with attacker-supplied DLL binaries. In observed exploitation attempts, this flaw was chained with a separate anonymous WebPartPage delivery bug to attempt pre-authentication execution on sites configured to allow anonymous viewing.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review SharePoint ULS and IIS logs for POST requests to /_layouts/15/AddGallery.aspx or /_layouts/15/designgallery.aspx with the query string DisplayMode=Edit, particularly large request bodies (exceeding 500 KB) or requests lacking a valid authentication cookie or Authorization header.
- Audit the SharePoint layouts directory for the presence of /_layouts/15/sphealth.aspx, which is not a legitimate SharePoint file; its presence is a strong indicator of successful exploitation and webshell deployment.
- Scan the SharePoint server for the DLL files wt3k3sij.dll (SHA-256: d3faa4b443d98f272363f3484a5e6a9bab90979086aa2d31a1694c1dc8178742) and 24e5mo4s.dll (SHA-256: a151a8fc193a96aac480fa749547b57c0f33116cf2cb8c82b6aa716c3c47f4b1), both PE32 x86 CLR images associated with observed exploitation activity.
Remediation
Additional hardening
- Update SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later, SharePoint Server 2019 to 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to 16.0.19725.20522 or later; see the vendor advisory in References for the full patch matrix.
- Disable anonymous viewing on all SharePoint sites where it is not operationally required; the observed pre-authentication exploitation chain depends on anonymous access being enabled, so removing it eliminates that attack path even on unpatched systems.
- Restrict network access to SharePoint layout pages (/_layouts/15/) at the perimeter or reverse proxy layer for sources outside the expected user population, reducing exposure to unauthenticated or opportunistic scanning.
- Conduct forensic triage of SharePoint servers for the webshell path and DLL indicators listed above, consistent with CISA's Forensics Triage Requirements referenced in the KEV entry, given confirmed active exploitation.
Key dates
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-65660
- https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660
Frequently asked questions
Does CVE-2026-65660 affect my FedRAMP authorization?
If Microsoft SharePoint runs inside your authorization boundary, yes. CVE-2026-65660 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of September 28, 2026. For a FedRAMP-authorized service, an unpatched KEV within your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2026-65660?
Knox does not patch your software. Remediating Microsoft SharePoint is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The patch is yours to apply; maintaining a defensible compliance posture while you apply it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-65660. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you a materially earlier window to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-65660 isn't remediated by September 28, 2026?
An unremediated CVE-2026-65660 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing out the finding and documenting the remediation is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
