Preliminary research

SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass

khoadha · Viettel Cyber Security · 22 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

SharePoint validated directive fragments separately before reconstructing markup. Splitting a registration directive across those fragments bypassed SafeControls checks and reached XAML execution gadgets. An alternate page hosted the vulnerable component; the anonymous chain required anonymous content access and a separate unpatched authentication path.

Record

Researcher

khoadha

Published by

Viettel Cyber Security

Date

22 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• TemplateParser background (Part 1)
• TemplateParser background (Part 2)
• Earlier SharePoint chain (2025)
• Generic XAML gadget background (August 2026)
• Earlier directive-injection analysis (May 2026, Vietnamese)

Tags

• sharepoint
• parser-differential
• type-confusion
• rce
• auth-bypass
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of khoadha, first published at the original source. Preserved copies are kept so the citation survives its host.