> ## Content Index
> Fetch the complete content index at: https://blog.previdian.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts
- URL: https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
- Published: 2026-09-24T13:04:25.000Z
- Updated: 2026-09-24T13:20:04.000Z
- Author: Ryan Dewhurst

On 24 September 2026, Previdian captured 12 exploitation requests targeting CVE-2026-65660 on a SharePoint honeypot. A single source sent two complementary payloads across six URL paths: the first attempted to disable a .NET deserialization safeguard, and the second carried a loader designed to decrypt and load an embedded assembly.

The payloads match the SafeControls quote-injection technique described in [Viettel Cyber Security’s research](https://blog.viettelcybersecurity.com/sharepoint%5Fcve-2026-65660/?ref=blog.previdian.com). CVE-2026-65660 itself requires authentication. These requests combine it with a separate anonymous delivery bug to attempt remote code execution before authentication, on sites configured to allow anonymous viewing.

For defenders, the immediate priority is to check remediation of both weaknesses, review anonymous-access settings, and look for the request and payload patterns below.

## Microsoft initially classified the flaw as spoofing

Microsoft initially published CVE-2026-65660 as a spoofing vulnerability with a **CVSS 3.1 base score of 6.5**. Its [11 August CVE record](https://github.com/CVEProject/cvelistV5/blob/0f5f65b77b1d2bcb93993d87069df8d9cc26fca4/cves/2026/65xxx/CVE-2026-65660.json?ref=blog.previdian.com) described an authorized attacker performing spoofing.

Microsoft subsequently changed the classification to **remote code execution** and the CVSS 3.1 base score to **8.8**. That change is present in the [27 August CVE record](https://github.com/CVEProject/cvelistV5/blob/2a9ed7a87a5eb19469a178ea6bcf15395ee122ce/cves/2026/65xxx/CVE-2026-65660.json?ref=blog.previdian.com). The [live MSRC advisory](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-65660?ref=blog.previdian.com) also lists RCE and records a 27 August revision to the title, impact, and FAQs. Microsoft labels that revision informational; the security update was released on 11 August.

[The Hacker News covered the classification discrepancy on 22 September](https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html?ref=blog.previdian.com). As checked on 24 September, the live advisory and Microsoft’s CVE record both describe authenticated RCE. Teams that initially prioritized this as a medium-severity spoofing issue should reassess that decision.

## What Previdian observed

The requests arrived around **12:00 UTC on 24 September 2026**. Each of the six paths received the same pair of bodies, with the smaller payload sent first.

| Observation             | Detail                                             |
| ----------------------- | -------------------------------------------------- |
| Source IP               | 169.150.248\[.\]21                                 |
| Network enrichment      | AS212238, Datacamp Limited                         |
| Destination             | One Previdian SharePoint honeypot                  |
| Request count           | 12 POST requests across six paths                  |
| Body sizes              | 7,834 bytes and 535,404 bytes, each sent six times |
| Target pages            | AddGallery.aspx and designgallery.aspx             |
| Query string            | job=all&DisplayMode=Edit                           |
| Form fields             | MSOTlPn\_Uri and MSOTlPn\_DWP                      |
| Authentication material | No cookies or Authorization header observed        |
| User-Agent              | Firefox 120                                        |

The base paths were `/_layouts/15/AddGallery.aspx` and `/_layouts/15/designgallery.aspx`. The sender also retried both pages with an additional `/_layouts/` or `/_layouts/15/` prefix. These are attempted URLs; the honeypot’s responses do not establish that every variant resolves to an exploitable page on a real deployment.

## Authentication: two separate bugs in one chain

CVE-2026-65660 itself requires authentication. [Microsoft’s advisory](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-65660?ref=blog.previdian.com) specifies low-level authenticated access and no user interaction. The `ToolpanePage` class behind the direct `ToolPane.aspx` route calls `SPUtility.EnsureAuthentication()` during `OnInit`, as shown in Viettel’s analysis.

The anonymous entry point comes from a separate issue described in the [Viettel write-up](https://blog.viettelcybersecurity.com/sharepoint%5Fcve-2026-65660/?ref=blog.previdian.com). Before its fix, a `WebPartPage` containing a zone, such as `AddGallery.aspx`, could create a `ToolPane` in edit mode without that authentication check. **This delivery path required the site to allow anonymous viewing.**

Viettel reports that the anonymous delivery issue was fixed on 9 June 2026, while the quote-injection vulnerability was fixed on 11 August 2026\. The two fixes address different parts of the chain:

| Component                      | Role in the observed attempt                                                                                                  | Reported fix date | Identifier                             |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ----------------- | -------------------------------------- |
| Anonymous WebPartPage delivery | Reach ToolPane processing through a page in edit mode, without an authenticated session, on a site allowing anonymous viewing | 9 June 2026       | Not identified in the Viettel write-up |
| SafeControls quote injection   | Bypass control validation and reach attacker-controlled deserialization                                                       | 11 August 2026    | CVE-2026-65660                         |

All 12 requests combine the anonymous delivery pattern, using `AddGallery.aspx` or `designgallery.aspx` with `DisplayMode=Edit` and no Cookie or Authorization header, with the CVE-2026-65660 quote-injection body. We therefore classify the traffic as an attempted pre-authentication chain, dependent on both weaknesses and the anonymous viewing configuration.

Viettel’s author explicitly states that he does not know the CVE identifier for the June issue. The two payload stages below are designed to prepare the runtime and then load additional code.

### Stage one: disable the deserialization safeguard

The first body was **7,834 bytes** long and was identified in the payload analysis as the `ActivitySurrogateDisableTypeCheck` gadget. The [ysoserial.net generator](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Generators/ActivitySurrogateDisableTypeCheck.cs?ref=blog.previdian.com) is specifically intended to disable the ActivitySurrogateSelector type protection.

### Stage two: deliver an encrypted assembly loader

The second body, **535,404 bytes** long, followed immediately on each path.

It contained an ActivitySurrogate gadget involving `AxHost+State` and `ActivitySurrogateSelector+ObjectSurrogate`. Embedded within it was a generated assembly named `wt3k3sij.dll`, containing a loader type named `SdLoader`.

The loader contains an AES decryption routine and a call to `Assembly.Load(byte[])`. Relevant method references include `CreateDecryptor`, `set_IV`, `TransformFinalBlock`, and `FromBase64String`.

 The decrypted final assembly has not been recovered in the available analysis, so its concrete behavior is unresolved.

## How the traffic compares with the public exploit

The observed payloads follow Viettel’s published markup, with a meaningful difference in how the first stage is packaged:

| Component                 | Published approach                                                | Previdian observation                                                                   |
| ------------------------- | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Safeguard-disabling stage | Place the generator’s XAML directly in ExpandedElement            | Keep the outer LosFormatter wrapper and place the serialized disabling gadget inside it |
| Assembly-loading stage    | Serialize an ActivitySurrogateSelector payload using LosFormatter | ActivitySurrogate payload containing the SdLoader assembly loader                       |
| Anonymous delivery        | A WebPartPage with a zone; AddGallery.aspx is the named example   | Requests to AddGallery.aspx, designgallery.aspx, and repeated layout-prefix variants    |

That first-stage difference matters when assessing whether the attempt could succeed. The [TypeConfuseDelegate XAML gadget](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Generators/TypeConfuseDelegateGenerator.cs?ref=blog.previdian.com) invokes `XamlReader.Parse()`, while Viettel’s direct-XAML approach uses `XamlServices.Parse()`. The researcher reports registry-permission failures with the former, motivating the alternative parsing path. We have not demonstrated that the captured variant overcomes that constraint on a real SharePoint installation.

These requests also differ from the older ToolShell traffic centered on `ToolPane.aspx`. Hunting only for that endpoint would miss the paths used in this burst.

## Detection and investigation guidance

Start with POST requests to `AddGallery.aspx` and `designgallery.aspx`, including paths containing repeated `/_layouts/` segments. Look for `DisplayMode=Edit` and closely spaced requests from the same source.

Use the following artifacts to support correlation:

| Artifact                                         | Investigation value                                                                                |
| ------------------------------------------------ | -------------------------------------------------------------------------------------------------- |
| 169.150.248\[.\]21                               | Source of this observed burst; match against the recorded time window                              |
| wt3k3sij.dll                                     | Assembly name embedded in the second payload; a file with this name was not observed being written |
| SdLoader                                         | Loader type within that embedded assembly                                                          |
| http://asdf/\_controltemplates/15/AclEditor.ascx | Value supplied in an exploit form field; not established as command-and-control infrastructure     |

## What defenders should do now

Prioritize checking affected SharePoint deployments against [Microsoft’s advisory for CVE-2026-65660](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-65660?ref=blog.previdian.com) and the applicable SharePoint update history. The advisory lists SharePoint Server 2016, 2019, and Subscription Edition. Apply all applicable update packages for the installed product, as Microsoft’s FAQ requires; verify the update and configuration steps have completed across the deployment.

Review sites that allow anonymous viewing, because that configuration is a prerequisite for the delivery route described here. Fixing the June issue closes that anonymous route; remediation of the authenticated CVE-2026-65660 vulnerability still requires its applicable fix.

This capture shows an attempted chain of two distinct vulnerabilities, delivered through two payload stages. It does not identify the operator, reveal the encrypted final payload, or show compromise elsewhere. Automated testing or research cannot be excluded solely from the requests, but the payloads clearly attempt to exercise the code execution chain.

Previdian uses proprietary sensors to surface these exploitation signals with the evidence needed for defenders to assess them. [View the CVE-2026-65660 record](https://previdian.com/CVE-2026-65660?ref=blog.previdian.com).