Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass

blog.viettelcybersecurity.com | vulnerability | CVE-2026-65660 | #rce | #pre-auth | #sharepoint | #cve-2026-65660 | #safecontrols-bypass | #in-memory-webshell | #type-check-bypass

Summary

Breakdown of CVE-2026-65660, a SafeControls type-check bypass in SharePoint. It shows an in-memory webshell technique chaining into pre-auth RCE, affecting all versions through Subscription Edition.
CVE
CVE-2026-65660
Published
Collected

original ↗

Related coverage

vulnerability · blog.viettelcybersecurity.com
SharePoint ToolShell – One Request PreAuth RCE Chain
The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
tool · github.com
CVE-2026-55040 PoC: Microsoft SharePoint JWT authentication bypass
The public PoC can generate a forged authentication token for a specified account, substantially lowering the barrier to validation and reproduction. Apply Microsoft security updates immediately and test only in isolated, authorized environments.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login
CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-20963 Analysis
CVE-2026-20963: inconsistently normalized TagPrefix values in Register Directives let HTML-encoded whitespace slip past SharePoint SafeControls validation; fixed in the KB5002825 update.
back