PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-20963 Analysis

blog.viettelcybersecurity.com | vulnerability | CVE-2026-20963 | #rce | #sharepoint | #patch-analysis | #safecontrols | #cve-2026-20963 | #register-directive
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-20963: inconsistently normalized TagPrefix values in Register Directives let HTML-encoded whitespace slip past SharePoint SafeControls validation; fixed in the KB5002825 update.
CVE
CVE-2026-20963
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
Phân tích CVE-2026-20963
A diff-based analysis of SharePoint CVE-2026-20963 shows the KB5002825 patch hardened Register Directive parsing, which attackers could abuse to bypass SafeControls checks and reach RCE.
vulnerability · blog.viettelcybersecurity.com
Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE
A patch-diff analysis of CVE-2022-22005 (CVSS 8.8), a SharePoint RCE, tracing Microsoft's fix to a serialization binder restricting types during ChartPreviewImage.loadChartImage() deserialization.
vulnerability · blog.viettelcybersecurity.com
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
Breakdown of CVE-2026-65660, a SafeControls type-check bypass in SharePoint. It shows an in-memory webshell technique chaining into pre-auth RCE, affecting all versions through Subscription Edition.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login
CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
vulnerability · blog.viettelcybersecurity.com
SharePoint ToolShell – One Request PreAuth RCE Chain
The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
Back