Inspected Fragments Became Dangerous
Microsoft confirmed exploitation of CVE-2026-65660 on 25 September. The SharePoint vulnerability permits a low-privilege account to send a crafted network request and execute server instructions without another person’s interaction. Its original exploitation assessment predates that confirmation.
CISA listed the flaw that day. Covered US federal civilian agencies faced a 28 September remediation deadline and applicable forensic triage requirements. That deadline has passed; it is not a universal legal deadline. Neither notice names the attackers or quantifies successful compromises.
Viettel’s analysis shows checked markup becoming unsafe after recombination. Design-time parsing and XAML processing can create a shell within RAM without depositing an ASPX file.
Anonymous exploitation additionally needs a WebPartPage-derived page, a WebPartZone, usable parsing and anonymous-content access. The vendor’s base case needs limited rights; anonymous exposure depends on configuration.
The researcher separates June’s repaired anonymous entry from another parser available after July’s update. The August fix normally disables the examined ToolPane function. Other parsers and memory shells need monitoring.
Investigate
The 11 August advisory lists these first corrected builds. They are vulnerability-specific thresholds, not a claim that an obsolete product has returned to support:
- Enterprise Server 2016: 16.0.5565.1001.
- Server 2019: 16.0.10417.20198.
- Subscription Edition: 16.0.19725.20522.
The current vendor table omits 2013; those build numbers do not apply to it. Its support ended in April 2023; the first two lines in the table above ended support in July 2026. Treat surviving obsolete farms as lifecycle and exposure risks alongside this investigation.
- Inventory every local farm, including legacy deployments.
- Check every farm member’s installed updates against the build table; install every applicable package.
- Check unauthenticated viewing and publicly reachable WebPart pages.
- Preserve web/proxy logs; hunt anomalous design/WebPart requests, complex register directives and encoded payloads.
- Inspect worker-process memory, loaded assemblies and child processes on suspected compromises.
- Reduce exposure; monitor continuously. Clean web roots and patches cannot exclude earlier compromise.
Sources
Research (22 September 2026); vendor advisory; federal catalogue; lifecycle notices for earlier releases and 2026.
