Public research shows SharePoint flaw permits authenticated code execution

A SharePoint Server vulnerability Microsoft initially rated as a moderate spoofing issue can let an authenticated attacker execute code, according to technical details and working exploit markup published by Viettel Cyber Security researcher Dinh Ho Anh Khoa. CVE-2026-65660 affects SharePoint Server 2016, 2019 and Subscription Edition. The flaw lets an attacker bypass a filter for server-side controls by injecting directives through unescaped quotation marks, then load arbitrary .NET classes and trigger code execution. Microsoft issued a patch on August 11, and the exploit can reach unauthenticated servers only when combined with a separate bypass already fixed on June 9. No exploitation in the wild has been reported.