CISA Catalogs Exploited SharePoint and MikroTik Flaws

Executive Summary

On September 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog, adding two vulnerabilities that are confirmed to be under active exploitation. The first is CVE-2026-65660, a critical remote code execution (RCE) vulnerability in Microsoft SharePoint. The second is CVE-2026-67279, a medium-severity flaw in MikroTik RouterOS that can be chained with another vulnerability to achieve full remote administrative control. The inclusion in the KEV catalog mandates that Federal Civilian Executive Branch (FCEB) agencies apply patches or mitigations by September 28, 2026, and serves as a strong advisory for all organizations to prioritize remediation.

Vulnerability Details

Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660)

• CVE ID: CVE-2026-65660
• Affected Product: Microsoft SharePoint
• CVSS Score: 8.8 (High)
• Vulnerability Type: Remote Code Execution (RCE)
• Description: This vulnerability allows an authenticated attacker to execute arbitrary code over the network. Although initially classified by Microsoft as a spoofing flaw, its severity was later upgraded to RCE. On September 25, Microsoft confirmed it had evidence of active exploitation, though details about the attackers or the scope of the attacks were not provided. This type of vulnerability is highly dangerous as SharePoint servers often store sensitive internal documents and are frequently internet-facing.

MikroTik RouterOS Improper Workflow Enforcement (CVE-2026-67279)

• CVE ID: CVE-2026-67279
• Affected Product: MikroTik RouterOS
• CVSS Score: 6.9 (Medium)
• Vulnerability Type: Improper Enforcement of Behavioral Workflow
• Description: This flaw allows an unauthenticated client to open a session channel and send an execution request. While only medium severity on its own, security researchers at CERT Polska have demonstrated that it can be chained with another vulnerability, CVE-2026-86060. This exploit chain, dubbed "MikroTrick," allows for unauthenticated, full administrative control over vulnerable, internet-exposed routers. This gives an attacker complete control over the network device, allowing them to intercept traffic, modify routing, or use the device as a pivot point.

Exploitation Status

Both vulnerabilities are confirmed by CISA to be actively exploited in the wild. The inclusion in the KEV catalog is based on reliable evidence of ongoing attacks. Threat actors often scan for and exploit vulnerabilities in widely used products like SharePoint and RouterOS shortly after they are disclosed or a proof-of-concept is released. The "MikroTrick" exploit chain highlights the risk of vulnerability chaining, where lower-severity flaws are combined to achieve a critical impact.

Impact Assessment

• SharePoint (CVE-2026-65660): A compromise of a SharePoint server can lead to a massive internal data breach. Attackers can gain access to all documents stored on the platform, which could include intellectual property, financial records, and employee PII. The server can also be used as a foothold to move laterally within the corporate network.
• MikroTik (CVE-2026-67279): A compromised router gives an attacker control over a network's traffic. This can be used for espionage (man-in-the-middle attacks), disrupting services (denial-of-service), or launching further attacks from a trusted position within the network. Given MikroTik's popularity in small-to-medium businesses and emerging markets, a large number of devices are likely vulnerable.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Vulnerability Scanning: Use a vulnerability scanner to actively identify SharePoint servers and MikroTik routers on your network that are vulnerable to these CVEs. D3FEND's D3-VSD - Vulnerability Scan Detection can help identify scanning activity.
• Log Analysis: For SharePoint, analyze IIS and SharePoint ULS logs for signs of exploitation attempts. For MikroTik, enable and forward system logs to a central SIEM to monitor for unauthorized login attempts or configuration changes.

Remediation Steps

1. Prioritize and Patch: The primary remediation is to apply the security updates provided by Microsoft and MikroTik for these vulnerabilities. Due to their KEV status, these should be treated as critical patches. This is a core tenet of D3FEND's D3-SU - Software Update.
2. Follow BOD 26-04: Federal agencies must remediate these flaws by the September 28, 2026 deadline. All other organizations are strongly encouraged to do the same.
3. Reduce Attack Surface: If patching is not immediately possible, restrict access to SharePoint servers and MikroTik management interfaces. Do not expose administrative interfaces to the public internet. Use a VPN with multi-factor authentication for remote management.