CISA Adds SharePoint and MikroTik RouterOS Flaws to Exploited Vulnerabilities List
This digest was compiled by AI from multiple sources — links to the originals are below.
The U.S. Cybersecurity and Infrastructure Security Agency on Friday added two security flaws affecting Microsoft SharePoint and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog, citing active exploitation. The flaws, CVE-2026-65660 and CVE-2026-67279, enable remote code execution and unauthenticated administrative access respectively. Federal agencies have until September 28, 2026, to apply required fixes.
Key Facts
- CISA added CVE-2026-65660, a SharePoint code injection flaw with CVSS 8.8, to its KEV catalog on Friday.
- CVE-2026-67279 in MikroTik RouterOS has been chained with CVE-2026-86060 in an exploit called MikroTrick to gain full unauthenticated admin access.
- Microsoft confirmed reliable evidence of observed attacks against CVE-2026-65660 as of September 25, 2026.
- Federal Civilian Executive Branch agencies must remediate CVE-2026-86060 by September 28, 2026.
SharePoint Vulnerability
CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint with a CVSS score of 8.8. Microsoft initially described the flaw as a spoofing issue but later updated its advisory to confirm remote code execution. As of September 25, 2026, Microsoft had reliable evidence of observed attacks exploiting the vulnerability. Microsoft has not disclosed the attackers, the start date of exploitation, the number of targeted organizations, or post-exploitation activities.
MikroTrick Exploit Chain
CVE-2026-67279, an improper enforcement of behavioral workflow flaw in MikroTik RouterOS, has been chained with CVE-2026-86060, an argument injection flaw in the login process. The combined exploit, named MikroTrick, allows full unauthenticated access to the administrative console of internet-exposed routers. CERT Polska confirmed that combining the two vulnerabilities resulted in full unauthenticated access to the administrative console. Bishop Fox reproduced the complete administrative takeover on vulnerable RouterOS 7.x builds. Security researcher Emilio Gallegos described MikroTrick as combining two failures at different trust boundaries.
1 source
Time · lag behind first