SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

Technical details and a public proof of concept show that CVE-2026-65660 in Microsoft SharePoint Server can enable authenticated remote code execution, despite initially being described as a spoofing issue. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition, where crafted web-part markup can bypass SafeControls checks and load arbitrary .NET classes. Microsoft patched the issue in its August 11 security updates; no in-the-wild exploitation has been reported.