ToolShell's author publishes a working code-execution exploit for SharePoint's CVE-2026-65660

The bug is in how SharePoint checks its SafeControls list, the filter that stops dangerous classes loading. When the ToolPane component processes web-part markup, it rebuilds Register directives by writing attribute values between double quotes and does not escape quotes inside those values ^[10]. An attacker closes a quote early and injects additional directives. That registers arbitrary .NET classes after the type check has run and before the control is loaded ^[11]. From there the exploit calls XamlServices.Parse() and gets code execution through deserialization ^[12]. Khoa's writeup includes a working in-memory webshell that, he said, avoids the registry permission failures other deserialization methods encounter ^[13].

Two records Microsoft publishes describe that outcome differently. The advisory says an authorized attacker can perform spoofing, and assigns no impact to integrity or availability ^[3]. The CVE record, updated on September 11, titles the same flaw a remote code execution vulnerability and says an authorized attacker can execute code ^[5]. The National Vulnerability Database scores it 8.8, which is 2.3 points above the advisory's 6.5 ^[4][1]. Both records assign CWE-94, a code-injection weakness ^[6]. Anyone who ranked this in August off the advisory queued a moderate spoofing bug ^[9].

The patch shipped in the August 11 security updates, and according to Khoa it also turns the vulnerable function off by default ^[7][8]. The reclassification arrived 31 days later ^[2]. For farms patched on schedule, the label mismatch cost nothing. For farms where a 6.5 spoofing flaw was deferred to a quarterly window, the exploit markup is now public and the server is still vulnerable ^[19].

Khoa also chained the flaw with a separate authentication bypass to reach pre-authentication code execution on servers configured to allow anonymous page access ^[14]. He says that bypass was fixed in a June 9 patch and that servers which applied it are not exposed on that path ^[15]. Farms missing both the June and August updates take this unauthenticated ^[3].

Khoa's earlier SharePoint disclosures were picked up quickly. He demonstrated the original ToolShell chain at Pwn2Own Berlin in May 2025, Chinese state-backed groups later exploited it, and Microsoft shipped emergency patches ^[16]. His CVE-2026-55040 authentication bypass was exploited shortly after the details became public in August ^[17].

No exploitation of CVE-2026-65660 has been reported in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog ^[18]. Microsoft rates exploitation unlikely ^[19]. Khoa says he has used the exploit in penetration testing engagements ^[20]. He also says SharePoint 2013 is affected, while Microsoft's advisory lists only 2016, 2019 and Subscription Edition ^[21]. SharePoint 2013 has received no security updates since support ended in April 2023 ^[22].