U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited Microsoft SharePoint and MikroTik RouterOS flaws to KEV, due September 28.
CISA added CVE-2026-65660 and CVE-2026-67279 to the Known Exploited Vulnerabilities catalog, ordering federal agencies to fix them by September 28, 2026, under BOD 22-01. CVE-2026-65660 (CVSS 8.8) is a Microsoft SharePoint Server code-injection flaw in 2016, 2019, and Subscription Edition that lets an authenticated low-privileged attacker execute arbitrary code. CVE-2026-67279 (CVSS 6.9) is a MikroTik RouterOS SSH flaw that lets an unauthenticated attacker bypass authentication, open a session, and run commands. CERT Polska says exploitation dates to at least September 2, 2026, and chaining it with CVE-2026-86060 can give full administrative access.
- CISA KEV now includes SharePoint CVE-2026-65660 and RouterOS CVE-2026-67279.
- Federal agencies must remediate both flaws by September 28, 2026.
- SharePoint bug allows low-privileged authenticated remote code execution on 2016, 2019, and Subscription Edition.
- MikroTik flaw is an unauthenticated SSH authentication bypass exploited since at least September 2.
- Chaining it with CVE-2026-86060 can yield full administrative access.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1021.004 Remote Services: SSH
- Organizations
- CISACERT Polska
- Countries
- United StatesPoland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
From the original article
1 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft SharePoint and Mikrotik RouterOS flaws flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.