CISA Adds SharePoint and MikroTik Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two critical security flaws affecting Microsoft SharePoint and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog. This designation confirms that both vulnerabilities are being actively exploited by threat actors in the wild. The move signals an urgent need for administrators of these platforms to apply patches immediately, as passive defense is no longer sufficient against current attack campaigns.

The first vulnerability, identified as CVE-2026-65660, impacts Microsoft Office SharePoint Server. Initially described by Microsoft as a spoofing issue, the advisory was later updated to clarify that the flaw allows for remote code execution (RCE). This means an attacker who can authenticate to the system could potentially run arbitrary code over the network. The Common Vulnerability Scoring System (CVSS) score for this flaw is 8.8, indicating a high severity level. Microsoft stated that as of September 25, 2026, it had reliable evidence of observed attacks targeting this specific vulnerability. However, the company has not disclosed details regarding the identity of the attackers, the timeline of the initial compromise, or the total number of organizations affected.

The second entry in the KEV catalog concerns MikroTik RouterOS, specifically addressing CVE-2026-67279. This flaw involves improper enforcement of behavioral workflows, which could allow an unauthenticated client to open a session channel and send execution requests. CERT Polska reported that this vulnerability is often chained with another argument injection flaw, CVE-2026-86060, in an exploit codenamed MikroTrick. By combining these two issues, attackers can achieve full administrative control of internet-exposed routers without needing a password. CVE-2026-86060 was previously added to the KEV catalog on September 11, 2026, giving Federal Civilian Executive Branch (FCEB) agencies until September 28, 2026, to implement fixes.

Security researchers at Bishop Fox have independently reproduced the complete administrative takeover on vulnerable RouterOS 7.x builds. Emilio Gallegos, a researcher at Bishop Fox, explained that MikroTrick exploits failures at different trust boundaries. The first failure allows an unauthenticated connection to reach functionality that should only be accessible after login. The second causes the login process to treat data from that connection as a trusted administrative identity. This design risk highlights how features intended for local callers can become remote attack surfaces when upstream components lose track of authentication state.

For website owners and IT teams relying on Microsoft SharePoint for document management or collaboration, the presence of CVE-2026-65660 in the wild underscores the importance of keeping server software updated. Similarly, businesses using MikroTik equipment for network infrastructure must address CVE-2026-67279 and CVE-2026-86060 to prevent unauthorized router access. Proactive patching remains the most effective mitigation strategy against these known exploitation techniques. AEU-I provides security-first IT infrastructure and consulting services to help organizations identify and remediate such vulnerabilities across their systems.