SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA listed actively exploited SharePoint RCE and MikroTik RouterOS flaws in the KEV catalog.
CISA added CVE-2026-65660 in Microsoft SharePoint and CVE-2026-67279 in MikroTik RouterOS to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. Microsoft revised CVE-2026-65660, CVSS 8.8, from spoofing to remote code execution and said it had reliable evidence of attacks as of September 25, 2026. CVE-2026-67279, CVSS 6.9, is chained with already-listed CVE-2026-86060 in the MikroTrick exploit to gain full unauthenticated administrative control of exposed RouterOS 7.x devices. Federal civilian agencies have until September 28, 2026, to patch.
- CVE-2026-65660 is a SharePoint flaw Microsoft now describes as remote code execution.
- Microsoft reported reliable evidence of SharePoint exploitation as of September 25, 2026.
- MikroTrick chains CVE-2026-67279 and CVE-2026-86060 for passwordless RouterOS takeover.
- Federal civilian agencies must apply fixes by September 28, 2026.
- Products
- SharePointRouterOS
- Organizations
- CISACERT PolskaBishop Fox
- Countries
- United StatesPoland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.