CVE-2026-65660: Microsoft SharePoint 'Spoofing' Flaw Is Actually Authenticated RCE — Detection and Remediation Guide

Microsoft classified CVE-2026-65660 as a spoofing vulnerability with a CVSS score of 6.5. Full technical details published by Viettel Cyber Security researcher Dinh Ho Anh Khoa demonstrate that the flaw is materially worse than the advisory language suggests: it enables authenticated remote code execution on SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. If you deprioritized this patch based on the 6.5 score and the 'spoofing' label, that triage decision needs to be revisited today.

Introduction: Severity Labels Drive Patching Decisions — and This One Was Wrong

Every vulnerability management program I've run or advised uses CVSS and vendor severity language as a primary input to patch prioritization. That's rational — you cannot patch everything at once. But it creates a systemic risk: when a vendor under-scores a flaw, it gets scheduled for next month's maintenance window instead of this week's emergency change. CVE-2026-65660 is exactly that scenario.

A 'spoofing' classification implies an attacker can masquerade as something they're not — bad, but bounded. Remote code execution on a SharePoint farm server is categorically different. SharePoint sits at the center of enterprise document management, frequently holds the most sensitive unstructured data in the organization (contracts, HR records, M&A material), and typically runs with broad internal network reach and high-privilege service accounts. RCE on SharePoint is a beachhead, a data theft opportunity, and a lateral movement pivot all in one.

We learned this lesson the hard way in July 2025 with the ToolShell campaign (CVE-2025-53770 / CVE-2025-53771), where SharePoint flaws were mass-exploited for unauthenticated RCE and webshell deployment within days of disclosure, compromising hundreds of organizations before many had patched. The defensive posture for CVE-2026-65660 should assume a similar exploitation trajectory: now that full technical details are public, working exploit code is a matter of days, not weeks.

Technical Analysis

Affected Products

• Microsoft SharePoint Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

SharePoint Online (Microsoft 365) is not affected — this is an on-premises problem, which means the patching burden falls entirely on you.

Vulnerability Profile

Why 'Authenticated' Is Cold Comfort

The authentication requirement is the only thing standing between this flaw and ToolShell-scale mass exploitation, and defenders should not over-weight it. In real environments, 'authenticated' SharePoint access is trivially obtainable:

• Credential stuffing and password spraying against on-prem SharePoint and its adjacent identity infrastructure is a constant background hum of attack traffic.
• Phished credentials remain the top initial access vector in nearly every IR dataset we work with.
• Low-privilege domain users typically have some SharePoint site access by design — SharePoint's entire purpose is broad internal collaboration.
• Compromised service accounts and stale contractor/vendor accounts with SharePoint access are pervasive in mature environments.

Once an attacker holds any valid SharePoint-authenticated session, CVE-2026-65660 converts that foothold into code execution in the context of the SharePoint web application pool identity (typically w3wp.exe running as the farm account) — which frequently has database access, and in poorly segmented environments, far more.

Exploitation Status

• Full technical details: publicly released by the researcher. This dramatically compresses the time-to-exploit for threat actors.
• Active exploitation: Not confirmed in the source reporting at time of writing — but treat 'public technical writeup + on-prem SharePoint + RCE' as functionally pre-exploited. The ToolShell precedent showed weaponization timelines measured in hours-to-days once details circulate.
• CISA KEV: Not listed as of this writing. Monitor the KEV catalog — SharePoint CVEs have historically been added quickly once exploitation begins.

Expected Post-Exploitation Behavior (What We Hunt)

Based on the attack class and documented SharePoint exploitation tradecraft from the 2025 ToolShell intrusions, successful exploitation of CVE-2026-65660 will most likely manifest as:

1. The IIS worker process (w3wp.exe) spawning child processes — cmd.exe, powershell.exe, certutil.exe, or other LOLBins. This is the canonical SharePoint RCE artifact.
2. Webshell deployment — attacker-authored .aspx / .ashx files dropped into SharePoint web directories, particularly the _layouts virtual directory (e.g., C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\ on SharePoint 2019/SE, ...\15\... on 2016), which is directly web-accessible without authentication in many configurations.
3. MachineKey theft / ViewState abuse — post-exploitation theft of ASP.NET machine keys from SharePoint configuration to enable persistent, signed ViewState payloads that survive patching (this exact technique was central to ToolShell persistence).
4. Outbound C2 from the SharePoint server to unfamiliar external infrastructure.

The detections below target these behaviors.

Detection & Response

Sigma Rules

---
title: SharePoint W3WP Worker Process Spawning Command Shell or Scripting Engine
id: 3f8a2c91-6d47-4e1b-b9a2-5c7d8e9f0a1b
status: experimental
description: Detects the SharePoint IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe, or other command/script interpreters — a hallmark of SharePoint RCE exploitation including webshell interaction and post-exploitation activity consistent with CVE-2026-65660 and prior SharePoint exploit chains.
references:
  - https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
  filter_iis_admin:
    ParentCommandLine|contains: 'iis'
    CommandLine|contains:
      - 'appcmd'
falsepositives:
  - Rare legitimate SharePoint admin tooling or backup agents invoking shells under the farm app pool identity — baseline and tune per environment
level: high
---
title: Webshell Dropped Into SharePoint LAYOUTS Directory
id: 8b1d4e62-3a95-4f08-c2d7-6e9f1a2b3c4d
status: experimental
description: Detects creation or modification of ASPX/ASHX files in SharePoint TEMPLATE LAYOUTS directories by non-deployment processes. This technique was central to ToolShell (CVE-2025-53770) intrusions and is the expected persistence mechanism following CVE-2026-65660 exploitation.
references:
  - https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
  filter_legit_writers:
    Image|endswith:
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\setup.exe'
      - '\psconfig.exe'
      - '\psconfigui.exe'
      - '\TrustedInstaller.exe'
  condition: selection_path and selection_ext and not filter_legit_writers
falsepositives:
  - In-house SharePoint solution deployments (WSP installs) — correlate with change windows and the SharePoint farm account
level: critical
---
title: SharePoint Configuration or MachineKey File Access by Unusual Process
id: c7e2f5a8-1b64-4d39-a8e1-9f0c2d4e6b7a
status: experimental
description: Detects reads of SharePoint/ASP.NET configuration files (web.config containing machineKey material) by processes other than IIS and legitimate SharePoint tooling. MachineKey theft enables persistent signed ViewState RCE that survives patching, as documented in the 2025 ToolShell campaign.
references:
  - https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\web.config'
    TargetFilename|contains:
      - '\inetpub\'
      - '\Web Server Extensions\'
  filter_iis:
    Image|endswith:
      - '\w3wp.exe'
      - '\svchost.exe'
      - '\iisreset.exe'
      - '\inetinfo.exe'
  condition: selection and not filter_iis
falsepositives:
  - Backup and file-sync agents — exclude known backup process paths after verification
  - AV/EDR scanning engines
level: high

KQL — Microsoft Sentinel / Defender for Endpoint

Hunt for SharePoint server compromise indicators: w3wp spawning shells, new script files in SharePoint web directories, and suspicious outbound connections from SharePoint hosts. Run over the last 14 days minimum, and extend retroactively if your farm was unpatched after the researcher's disclosure date.

// Hunt: SharePoint RCE post-exploitation behavior (CVE-2026-65660 class)
// Part 1: w3wp.exe spawning command interpreters or LOLBins
let SharePointServers = (DeviceInfo
    | summarize arg_max(Timestamp, *) by DeviceId
    | project DeviceName);
let Lookback = 14d;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","regsvr32.exe","whoami.exe","net.exe","nltest.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, SHA256
| order by Timestamp desc;
// Part 2: New executable web content written to SharePoint LAYOUTS/CONTROLTEMPLATES
DeviceFileEvents
| where Timestamp > ago(Lookback)
| where FolderPath has_any ("Web Server Extensions\\15\\TEMPLATE\\LAYOUTS","Web Server Extensions\\16\\TEMPLATE\\LAYOUTS","Web Server Extensions\\16\\TEMPLATE\\CONTROLTEMPLATES")
| where FileName endswith_cs ".aspx" or FileName endswith_cs ".ashx" or FileName endswith_cs ".asmx"
| where InitiatingProcessFileName !in~ ("msiexec.exe","TiWorker.exe","TrustedInstaller.exe","psconfig.exe","psconfigui.exe","setup.exe")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc;
// Part 3: Outbound connections from w3wp.exe to rare external destinations
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where RemoteIPType == "Public"
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteUrl, RemoteIP
| order by Connections asc; // rare destinations bubble to the top

Velociraptor VQL

Use this artifact to sweep your SharePoint farm for recently created or modified script content in web-accessible SharePoint directories — the highest-fidelity webshell artifact — and to enumerate suspicious child processes of the IIS worker.

-- Hunt: SharePoint webshell artifacts and suspicious w3wp child processes
-- Sweep LAYOUTS/CONTROLTEMPLATES for script files modified in the last 30 days
SELECT FullPath, Size, Mtime, Atime,
       timestamp(epoch=atoi(string=Mtime.Sec)) AS ModifiedTime
FROM glob(globs=[
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/15/TEMPLATE/LAYOUTS/*.as*',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/*.as*',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/CONTROLTEMPLATES/*.as*'
])
WHERE Mtime.Sec > (now() - 2592000)
ORDER BY Mtime DESC

-- Separately: enumerate w3wp processes and any children
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'w3wp'
   OR Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'w3wp')

Any .aspx/.ashx file in LAYOUTS with a modification timestamp that does not correlate with a documented patch or solution deployment is an incident until proven otherwise. Pull the file, hash it, and detonate it in a sandbox before deletion — you want to preserve evidence and understand the intrusion scope.

Immediate Triage Script

Run this on each SharePoint front-end and application server to (a) confirm installed SharePoint build versus patched state, (b) inventory recently modified web content in LAYOUTS, and (c) list any non-standard child processes spawned by IIS in the last 7 days.

# CVE-2026-65660 SharePoint triage and verification script
# Run elevated on each SharePoint farm server

Write-Host "=== SharePoint Build Inventory ===" -ForegroundColor Cyan
$sp16 = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0"
$sp15 = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0"
foreach ($key in @($sp15, $sp16)) {
    if (Test-Path $key) {
        $ver = Get-ItemProperty -Path (Join-Path $key "WSS") -ErrorAction SilentlyContinue
        Write-Host "$key  ->  SetupType: $($ver.SetupType)"
    }
}
# Authoritative build list from installed SharePoint product packages
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'SharePoint' } |
    Select-Object Name, Version, InstallDate | Format-Table -AutoSize

Write-Host "=== Recently Installed Updates (last 45 days) ===" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-45) } |
    Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn -AutoSize

Write-Host "=== Suspicious web content in LAYOUTS (modified last 30 days) ===" -ForegroundColor Cyan
$layouts = @(
    "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS",
    "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS",
    "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES"
)
foreach ($dir in $layouts) {
    if (Test-Path $dir) {
        Get-ChildItem -Path $dir -Include *.aspx,*.ashx,*.asmx -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime, @{N='SHA256';E={(Get-FileHash $_.FullName).Hash}} |
            Format-List
    }
}

Write-Host "=== w3wp child processes (last 7 days, from Sysmon/Security 4688 if logged) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'w3wp\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|mshta\.exe|certutil\.exe|rundll32\.exe' } |
    Select-Object TimeCreated, Message -First 50 | Format-List

Write-Host "=== Triage complete. Review output; any unexpected LAYOUTS files = open an IR case. ===" -ForegroundColor Yellow

Remediation

1. Patch immediately — re-triage this as critical. Microsoft has released security updates for CVE-2026-65660 covering SharePoint Server 2016, 2019, and Subscription Edition. Pull the exact KB and build numbers for your SKU from the Microsoft Security Update Guide entry for CVE-2026-65660 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660) and the associated Microsoft security advisory. Do not rely on the original 6.5/spoofing severity in your patching SLA — treat this as an RCE-tier emergency change.
2. Verify the patch actually landed. SharePoint patching is notoriously failure-prone: the update must be installed on every server in the farm, and psconfig (or the Products and Configuration Wizard) must be run to complete the upgrade — a binary-only install leaves the farm vulnerable. Confirm the build number post-patch against the MSRC advisory.
3. Rotate ASP.NET machine keys after patching. This is the step organizations skipped after ToolShell and paid for. If an attacker achieved code execution before patching, they may have stolen the farm's machineKey values, enabling signed malicious ViewState payloads that survive the patch. Rotate the machine keys on every web application and invalidate existing sessions. Follow Microsoft's published guidance on ViewState/machineKey rotation for SharePoint.
4. Rotate SharePoint farm and service account credentials if you find any evidence of compromise during the triage sweep above. Farm account compromise poisons the entire topology.
5. Hunt before you assume clean. Run the Sigma, KQL, and VQL content above retroactively over the window between Microsoft's initial (under-scored) advisory and your patch date. If your farm was internet-accessible and unpatched while technical details were public, assume a look-back investigation is warranted.
6. Reduce authentication exposure. Enforce MFA at any identity layer fronting SharePoint, disable NTLM where feasible in favor of Kerberos, audit stale accounts with SharePoint site access, and alert on SharePoint logons from unusual geographies or anonymizing infrastructure. 'Authenticated RCE' becomes far less exploitable when authentication is hardened.
7. Segment and restrict egress. SharePoint servers should not initiate arbitrary outbound internet connections. Egress filtering on farm servers breaks most C2 and exfiltration paths and converts a silent compromise into a noisy one.
8. Fix the process failure. Update your vulnerability prioritization model to weight researcher/community re-analysis of vendor severity. When a vendor advisory says 'spoofing' but a credible researcher publishes RCE details, the researcher's finding governs. Track CISA KEV additions for SharePoint CVEs as an escalation trigger regardless of CVSS.

Bottom line: CVE-2026-65660 is a reminder that vendor severity labels are a starting hypothesis, not ground truth. Patch your farms now, rotate your machine keys, and hunt the window of exposure — because with full technical details public, someone else is already working the exploit.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub