CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2026-65660 is an improper control of code generation (CWE-94) flaw in Microsoft Office SharePoint Server that allows an authenticated, low-privilege attacker to inject and execute arbitrary code over a network. The bug is triggered after login by sending crafted input that SharePoint processes and executes, so any account with basic access to the SharePoint site — including a standard user — is a viable attack path. Successful exploitation yields remote code execution on the SharePoint server with the privileges of the SharePoint service account, threatening full compromise of confidentiality, integrity, and availability (CVSS 8.8). Notably, Microsoft initially classified the flaw as spoofing before it was recharacterized as authenticated RCE, and Canada's Cyber Centre has issued advisory AL26-023 about it. A public proof-of-concept exists on GitHub, but the issue is not in CISA's KEV catalog and there are no confirmed reports of in-the-wild exploitation yet, though EPSS (1.2%, 67th percentile) suggests above-average likelihood of attempted exploitation.

Do: Apply Microsoft's security update for SharePoint Server from the corresponding Patch Tuesday release as soon as possible, prioritizing any server reachable from the internet or exposed to broad internal user populations. Because exploitation only requires an authenticated low-privilege account, review recent SharePoint audit logs for anomalous behavior by ordinary users (unexpected page/app modifications, unusual requests preceding process activity), and enforce least-privilege access so standard accounts cannot reach sensitive site collections. Verify patch levels across all SharePoint farms, including pre-production and forgotten servers, and monitor Microsoft's advisory and the Canadian Cyber Centre's AL26-023 for updates on active exploitation.

CVE-2026-67279 is an authentication-ordering flaw (CWE-841) in the SSH server of MikroTik RouterOS: after a client-requested SSH rekey, the server enters the connection protocol even though user authentication was never attempted. An unauthenticated SSH client can therefore open a session channel and send an exec request, and on affected builds the server dispatches the command without any credentials. This lets the attacker create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data. Any MikroTik device running RouterOS builds older than the fixed releases is affected, although remote exploitation requires the SSH service to be reachable by the attacker. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.4% probability of exploitation in the next 30 days, so no exploitation is currently known.

Do: Upgrade RouterOS to 6.49.21 (Long-term v6), 7.23.4 (Long-term v7), or 7.24.2 (Stable). Until patched, restrict SSH access to trusted management networks/VPN or disable the SSH service where it is not needed. Review the RouterOS file list and SSH logs for unexpected or reconstructed files and session activity, since attackers have recently chained multiple MikroTik flaws against routers.