SharePoint Flaw Mislabeled as Spoofing Actually Allows Code Execution

A security flaw in Microsoft SharePoint has been reclassified from a moderate spoofing issue to a severe remote code execution vulnerability. While Microsoft's initial advisory assigned a CVSS score of 6.5 and described the problem as limited to spoofing, new technical details published by Viettel Cyber Security researcher Dinh Ho Anh Khoa show that the bug actually allows authorized attackers to execute arbitrary code on the server.

The vulnerability, identified as CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition. Although patches were released on August 11, the discrepancy in how Microsoft described the threat means many defenders may have deprioritized the fix. The National Vulnerability Database now scores the issue at 8.8, reflecting its true potential for damage rather than the lower severity originally suggested.

Misleading labels create security gaps

According to The Hacker News, the core issue lies in how SharePoint handles server-side controls. When processing specific markup, the system fails to properly escape quotes, allowing attackers to inject additional directives. This bypasses safety filters designed to prevent dangerous software components from loading, effectively turning a configuration check into a backdoor for malicious code.

This misclassification is dangerous because security teams rely on vendor advisories to gauge risk. A label indicating only spoofing suggests that data integrity and system availability are safe, leading administrators to delay patching. In reality, the flaw permits full code execution, a far more critical threat that requires immediate remediation to prevent server compromise.

Attackers can chain exploits for deeper access

Khoa demonstrated that the flaw can be combined with a previously patched authentication bypass to achieve pre-authentication remote code execution. This means that on servers configured to allow anonymous page access, an attacker does not need a valid login to exploit the vulnerability. The researcher provided a working payload that avoids common permission errors, making the exploit practical for real-world attacks.

The trade-off for organizations is clear: while the specific pre-authentication path requires a configuration that allows anonymous access, the base vulnerability remains a significant risk for any authenticated user. Even without the authentication bypass, any compromised account or session could be leveraged to take full control of the SharePoint server, rendering the initial spoofing classification dangerously inaccurate.

Patches exist but legacy versions remain exposed

Microsoft released fixes for this issue on August 11, which also disable the vulnerable function by default. However, the researcher notes that the flaw also affects SharePoint 2013, a version that Microsoft no longer supports. Since SharePoint 2013 stopped receiving security updates in April 2023, organizations still running this legacy version have no official patch available and must implement workarounds to protect their systems.

No widespread exploitation has been reported in the wild yet, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, with full technical details and exploit code now public, the window for safe remediation is closing. Administrators should verify their patch levels immediately, especially if they are using older, unsupported versions of the software.