Unauthenticated webPartMarkup POST to non-ToolPane WebPartPage endpoints

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects unauthenticated HTTP POST requests targeting SharePoint WebPartPage-derived endpoints using the 'webPartMarkup' parameter. This activity attempts to exploit a vulnerability (CVE-2026-65660) where anonymous access to specific pages bypasses authentication, allowing an attacker to invoke internal methods for malicious register-directive injection.