CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited SharePoint and MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog.
CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CVE-2026-65660 is a Microsoft SharePoint code injection flaw, and CVE-2026-67279 is a MikroTik RouterOS improper enforcement of behavioral workflow flaw. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of high-risk KEV entries on exposed assets. CISA urged all organizations to remediate cataloged vulnerabilities quickly.
- CVE-2026-65660 is a Microsoft SharePoint code injection vulnerability.
- CVE-2026-67279 is a MikroTik RouterOS behavioral-workflow enforcement flaw.
- CISA added both after evidence of active exploitation.
- BOD 26-04 directs federal agencies to prioritize these KEV entries.
- Products
- SharePointRouterOS
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
| CVE-2026-67279 | Unauthenticated SSH Session Bypass Enables File Writes in MikroTik RouterOS | 6.9 | 2% | KEVPoC ×4 | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.