SharePoint Pre-Auth RCE via EditingPageParser Type-Check Bypass

CVE-2026-65660 represents a critical vulnerability in Microsoft SharePoint's `EditingPageParser` and `ToolPane` components. The flaw stems from a failure to properly sanitize double and single quotes during the generation of Register directives in the `GetHtml` method. This allows an attacker to inject malicious directives and namespaces that bypass SafeControls filters, ultimately leading to the execution of arbitrary code via insecure deserialization.

Technically, the vulnerability leverages a logic flaw where processed Register markup and Tag markup are appended without validation. By injecting a `XamlServices.Parse()` call wrapped in a generic `ExpandedWrapper`, attackers can trigger deserialization of `LosFormatter` payloads. When combined with pages that inherit `WebPartPage` and allow anonymous access, this bypasses the standard authentication checks typically enforced by `ToolPanePage`.

This vulnerability affects all major versions of SharePoint, including 2013, 2016, 2019, and Subscription Edition. Given the ability to deploy in-memory webshells without authentication, this exploit poses a severe risk to internet-facing SharePoint deployments. Organizations are urged to apply the August 11, 2026, security updates immediately.