SharePoint anonymous POST with Register directive to non-ToolPane WebPartPage

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects an attempt to bypass SharePoint authentication using a 'Register' directive in a POST request body directed at an .aspx page that is not a recognized ToolPane page. This pattern is indicative of an exploit attempt against a public-facing SharePoint server, specifically targeting vulnerability CVE-2026-65660.