SharePoint w3wp.exe loading XAML deserialization assemblies (CVE-2026-65660)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the IIS worker process (w3wp.exe) used by SharePoint loading a specific combination of assemblies (PresentationFramework.dll, System.Xaml.dll, and System.Data.Services.dll). This behavior is indicative of an ExpandedWrapper/XamlServices.Parse() insecure deserialization gadget chain, typically associated with the exploitation of vulnerabilities like CVE-2026-65660, which enables fileless in-memory code execution.