CVE-2026-65665 Overview
CVE-2026-65665 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. An authenticated attacker can execute arbitrary code over the network by submitting crafted serialized objects to a vulnerable SharePoint endpoint. Microsoft published the advisory on August 11, 2026, and the issue affects Microsoft SharePoint Server Subscription Edition and SharePoint Server 2019.
Exploitation requires low-privilege authentication and no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the SharePoint server, which typically hosts business-critical documents and integrates with Active Directory identities.
Critical Impact
Authenticated attackers can achieve remote code execution on the SharePoint server, leading to full compromise of hosted content, service accounts, and downstream identity infrastructure.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- On-premises SharePoint deployments exposing affected web endpoints
Discovery Timeline
- 2026-08-11 - Microsoft releases security update for CVE-2026-65665
- 2026-08-11 - CVE-2026-65665 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65665
Vulnerability Analysis
The flaw resides in how Microsoft SharePoint Server processes serialized objects supplied through authenticated request paths. When SharePoint deserializes attacker-controlled data without adequate type validation, gadget chains present in loaded .NET assemblies can be invoked during object reconstruction. This behavior allows arbitrary code execution in the context of the SharePoint application pool identity.
The attack originates over the network and requires authentication with low privileges. No user interaction is needed, and the exploit scope remains within the vulnerable component while granting high impact to confidentiality, integrity, and availability. The EPSS score of 1.733% (75.588 percentile) reflects meaningful predicted exploitation activity relative to other published vulnerabilities.
Root Cause
The root cause is unsafe deserialization of untrusted input [CWE-502]. SharePoint accepts serialized payloads on authenticated endpoints and reconstructs objects without enforcing a strict allowlist of expected types. Attackers can craft payloads referencing dangerous gadget chains that trigger code execution during deserialization callbacks such as constructor, property setter, or ISerializable handlers.
Attack Vector
An attacker authenticates to SharePoint with any low-privilege account, including a standard site user. The attacker submits a crafted serialized object to a vulnerable handler over HTTP or HTTPS. SharePoint deserializes the object, invokes the embedded gadget chain, and executes attacker-controlled code under the SharePoint service account. From there, adversaries can pivot to Active Directory, extract SharePoint content, deploy web shells, or move laterally to connected systems.
No verified proof-of-concept code is publicly available at the time of publication. Refer to the Microsoft Security Update on CVE-2026-65665 for authoritative technical details.
Detection Methods for CVE-2026-65665
Indicators of Compromise
- Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity, such as cmd.exe, powershell.exe, or rundll32.exe
- New or modified .aspx, .ashx, or .asmx files under SharePoint web application directories consistent with web shell placement
- Outbound network connections from SharePoint servers to unfamiliar external hosts shortly after authenticated POST requests to SharePoint endpoints
- IIS logs showing authenticated POST requests with abnormally large body sizes to SharePoint handler URLs
Detection Strategies
- Hunt for .NET deserialization gadget patterns in IIS request bodies, including references to System.Windows.Data.ObjectDataProvider or System.Workflow.ComponentModel.Serialization
- Alert on process lineage where w3wp.exe launches script interpreters or LOLBins, mapped to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application)
- Correlate SharePoint authentication events with immediate high-privilege process creation on the same host
Monitoring Recommendations
- Enable verbose IIS logging, including request body sampling where feasible, and forward logs to a centralized analytics platform
- Monitor SharePoint ULS logs for deserialization exceptions and unexpected type resolution errors
- Baseline outbound traffic from SharePoint servers and alert on deviations that may indicate command-and-control activity
How to Mitigate CVE-2026-65665
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update on CVE-2026-65665 advisory to all affected SharePoint servers
- Inventory all on-premises SharePoint Server Subscription Edition and SharePoint Server 2019 instances, including development and staging environments
- Rotate machine keys, service account credentials, and any secrets stored within SharePoint after patching
- Review authentication logs for anomalous low-privilege account activity preceding the patch window
Patch Information
Microsoft published the fix on 2026-08-11 through the Microsoft Security Response Center. Administrators should install the corresponding cumulative update for SharePoint Server Subscription Edition or SharePoint Server 2019 from Microsoft Update or the Microsoft Update Catalog. Verify installation using SharePoint Central Administration and confirm the build number matches the fixed version listed in the advisory.
Workarounds
- Restrict authenticated access to SharePoint to trusted network segments using firewall rules or a reverse proxy pending patch deployment
- Enforce multi-factor authentication on all SharePoint accounts to reduce the pool of usable low-privilege credentials
- Run the SharePoint application pool under a least-privilege service account with no local administrator rights and constrained Active Directory permissions
- Disable or restrict SharePoint features and web parts that accept serialized input where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
