SharePoint ToolPane Register Directive Injection (CVE-2026-65660)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

These rules detect various exploitation attempts targeting SharePoint to bypass SafeControls, an security mechanism used to restrict the types of controls allowed in web parts. The patterns match suspicious Register directives and markup injection techniques often associated with remote code execution or privilege escalation, as identified in CVE-2026-65660.