CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts
On 24 September 2026, Previdian captured 12 exploitation requests targeting CVE-2026-65660 on a SharePoint honeypot. A single source sent two complementary payloads across six URL paths: the first attempted to disable a .NET deserialization safeguard, and the second carried a loader designed to decrypt and load an embedded assembly.
The payloads match the SafeControls quote-injection technique described in Viettel Cyber Security’s research. CVE-2026-65660 itself requires authentication. These requests combine it with a separate anonymous delivery bug to attempt remote code execution before authentication, on sites configured to allow anonymous viewing.
For defenders, the immediate priority is to check remediation of both weaknesses, review anonymous-access settings, and look for the request and payload patterns below.
Microsoft initially classified the flaw as spoofing
Microsoft initially published CVE-2026-65660 as a spoofing vulnerability with a CVSS 3.1 base score of 6.5. Its 11 August CVE record described an authorized attacker performing spoofing.
Microsoft subsequently changed the classification to remote code execution and the CVSS 3.1 base score to 8.8. That change is present in the 27 August CVE record. The live MSRC advisory also lists RCE and records a 27 August revision to the title, impact, and FAQs. Microsoft labels that revision informational; the security update was released on 11 August.
The Hacker News covered the classification discrepancy on 22 September. As checked on 24 September, the live advisory and Microsoft’s CVE record both describe authenticated RCE. Teams that initially prioritized this as a medium-severity spoofing issue should reassess that decision.
What Previdian observed
The requests arrived around 12:00 UTC on 24 September 2026. Each of the six paths received the same pair of bodies, with the smaller payload sent first.
| Observation | Detail |
|---|---|
| Source IP | 169.150.248[.]21 |
| Network enrichment | AS212238, Datacamp Limited |
| Destination | One Previdian SharePoint honeypot |
| Request count | 12 POST requests across six paths |
| Body sizes | 7,834 bytes and 535,404 bytes, each sent six times |
| Target pages | AddGallery.aspx and designgallery.aspx |
| Query string | job=all&DisplayMode=Edit |
| Form fields | MSOTlPn_Uri and MSOTlPn_DWP |
| Authentication material | No cookies or Authorization header observed |
| User-Agent | Firefox 120 |
The base paths were /_layouts/15/AddGallery.aspx and /_layouts/15/designgallery.aspx. The sender also retried both pages with an additional /_layouts/ or /_layouts/15/ prefix. These are attempted URLs; the honeypot’s responses do not establish that every variant resolves to an exploitable page on a real deployment.
Authentication: two separate bugs in one chain
CVE-2026-65660 itself requires authentication. Microsoft’s advisory specifies low-level authenticated access and no user interaction. The ToolpanePage class behind the direct ToolPane.aspx route calls SPUtility.EnsureAuthentication() during OnInit, as shown in Viettel’s analysis.
The anonymous entry point comes from a separate issue described in the Viettel write-up. Before its fix, a WebPartPage containing a zone, such as AddGallery.aspx, could create a ToolPane in edit mode without that authentication check. This delivery path required the site to allow anonymous viewing.
Viettel reports that the anonymous delivery issue was fixed on 9 June 2026, while the quote-injection vulnerability was fixed on 11 August 2026. The two fixes address different parts of the chain:
| Component | Role in the observed attempt | Reported fix date | Identifier |
|---|---|---|---|
Anonymous WebPartPage delivery | Reach ToolPane processing through a page in edit mode, without an authenticated session, on a site allowing anonymous viewing | 9 June 2026 | Not identified in the Viettel write-up |
| SafeControls quote injection | Bypass control validation and reach attacker-controlled deserialization | 11 August 2026 | CVE-2026-65660 |
All 12 requests combine the anonymous delivery pattern, using AddGallery.aspx or designgallery.aspx with DisplayMode=Edit and no Cookie or Authorization header, with the CVE-2026-65660 quote-injection body. We therefore classify the traffic as an attempted pre-authentication chain, dependent on both weaknesses and the anonymous viewing configuration.
Viettel’s author explicitly states that he does not know the CVE identifier for the June issue. The two payload stages below are designed to prepare the runtime and then load additional code.
Stage one: disable the deserialization safeguard
The first body was 7,834 bytes long and was identified in the payload analysis as the ActivitySurrogateDisableTypeCheck gadget. The ysoserial.net generator is specifically intended to disable the ActivitySurrogateSelector type protection.
Stage two: deliver an encrypted assembly loader
The second body, 535,404 bytes long, followed immediately on each path.
It contained an ActivitySurrogate gadget involving AxHost+State and ActivitySurrogateSelector+ObjectSurrogate. Embedded within it was a generated assembly named wt3k3sij.dll, containing a loader type named SdLoader.
The loader contains an AES decryption routine and a call to Assembly.Load(byte[]). Relevant method references include CreateDecryptor, set_IV, TransformFinalBlock, and FromBase64String.
The decrypted final assembly has not been recovered in the available analysis, so its concrete behavior is unresolved.
How the traffic compares with the public exploit
The observed payloads follow Viettel’s published markup, with a meaningful difference in how the first stage is packaged:
| Component | Published approach | Previdian observation |
|---|---|---|
| Safeguard-disabling stage | Place the generator’s XAML directly in ExpandedElement | Keep the outer LosFormatter wrapper and place the serialized disabling gadget inside it |
| Assembly-loading stage | Serialize an ActivitySurrogateSelector payload using LosFormatter | ActivitySurrogate payload containing the SdLoader assembly loader |
| Anonymous delivery | A WebPartPage with a zone; AddGallery.aspx is the named example | Requests to AddGallery.aspx, designgallery.aspx, and repeated layout-prefix variants |
That first-stage difference matters when assessing whether the attempt could succeed. The TypeConfuseDelegate XAML gadget invokes XamlReader.Parse(), while Viettel’s direct-XAML approach uses XamlServices.Parse(). The researcher reports registry-permission failures with the former, motivating the alternative parsing path. We have not demonstrated that the captured variant overcomes that constraint on a real SharePoint installation.
These requests also differ from the older ToolShell traffic centered on ToolPane.aspx. Hunting only for that endpoint would miss the paths used in this burst.
Detection and investigation guidance
Start with POST requests to AddGallery.aspx and designgallery.aspx, including paths containing repeated /_layouts/ segments. Look for DisplayMode=Edit and closely spaced requests from the same source.
Use the following artifacts to support correlation:
| Artifact | Investigation value |
|---|---|
169.150.248[.]21 | Source of this observed burst; match against the recorded time window |
wt3k3sij.dll | Assembly name embedded in the second payload; a file with this name was not observed being written |
SdLoader | Loader type within that embedded assembly |
http://asdf/_controltemplates/15/AclEditor.ascx | Value supplied in an exploit form field; not established as command-and-control infrastructure |
What defenders should do now
Prioritize checking affected SharePoint deployments against Microsoft’s advisory for CVE-2026-65660 and the applicable SharePoint update history. The advisory lists SharePoint Server 2016, 2019, and Subscription Edition. Apply all applicable update packages for the installed product, as Microsoft’s FAQ requires; verify the update and configuration steps have completed across the deployment.
Review sites that allow anonymous viewing, because that configuration is a prerequisite for the delivery route described here. Fixing the June issue closes that anonymous route; remediation of the authenticated CVE-2026-65660 vulnerability still requires its applicable fix.
This capture shows an attempted chain of two distinct vulnerabilities, delivered through two payload stages. It does not identify the operator, reveal the encrypted final payload, or show compromise elsewhere. Automated testing or research cannot be excluded solely from the requests, but the payloads clearly attempt to exercise the code execution chain.
Previdian uses proprietary sensors to surface these exploitation signals with the evidence needed for defenders to assess them. View the CVE-2026-65660 record.