thehackernews.com
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Microsoft originally labeled CVE‑2026‑65660, a SharePoint Server flaw affecting 2016, 2019 and Subscription Edition, as a spoofing issue with a CVSS of 6.5. Viettel Cyber Security researcher Dinh Ho Anh Khoa later revealed the vulnerability permits authenticated remote code execution, raising the NVD score to 8.8. The bug resides in the SafeControls check of the ToolPane component, where unescaped quotes allow injection of arbitrary .NET classes that are loaded via XamlServices.Parse(), enabling code execution. Patches released on [...]