Cybersecurity
CISA adds SharePoint and RouterOS flaws to KEV
The U.S. cyber agency listed two vulnerabilities in Microsoft SharePoint and MikroTik RouterOS after evidence of exploitation, while Microsoft, CERT Polska and Bishop Fox described attacks and an exploit chain.
- CISA added CVE-2026-65660 and CVE-2026-67279 to its Known Exploited Vulnerabilities catalogue on Friday after citing active exploitation.
- Microsoft said it had reliable evidence of attacks against CVE-2026-65660 as of 25 September 2026 and updated its advisory to say the issue could lead to remote code execution.
- CERT Polska said CVE-2026-67279 had been chained with CVE-2026-86060 in an exploit called MikroTrick.
- Bishop Fox said it reproduced full administrative takeover on vulnerable RouterOS 7.x builds.
- CISA had already added CVE-2026-86060 on 11 September 2026, and FCEB agencies had until 28 September 2026 to apply fixes.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalogue after saying there was evidence they were being used in attacks. The first, CVE-2026-65660, affected Microsoft Office SharePoint; the second, CVE-2026-67279, affected Mikrotik RouterOS.
Microsoft had originally described CVE-2026-65660 as a spoofing issue in SharePoint Server. It later revised the advisory to say the flaw could be used for remote code execution, and said it had reliable evidence of attacks by 25 September 2026.
For RouterOS, CERT Polska said CVE-2026-67279 had been used with CVE-2026-86060, an argument injection flaw in the login process, in an exploit chain called MikroTrick. The agency said the chain gave full administrative control of internet-exposed routers without a password.
Bishop Fox said it reproduced the takeover on vulnerable RouterOS 7.x builds. Security researcher Emilio Gallegos said the two flaws combined across separate trust boundaries, with one allowing a connection to reach functionality reserved for logged-in users and the other treating that connection as trusted identity.
CISA had already added CVE-2026-86060 on 11 September 2026. Federal Civilian Executive Branch agencies had until 28 September 2026 to apply the required fixes.
Named in this story
People
- Emilio Gallegos
- described the trust-boundary problem in the exploit chain
Companies
- Microsoft
- updated the SharePoint advisory and said it had evidence of attacks
- Bishop Fox
- said it reproduced the administrative takeover on vulnerable builds
Organisations
- CERT Polska
- said the RouterOS flaws had been chained in an exploit
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaws to its Known Exploited Vulnerabilities catalogue and cited active exploitation
- Federal Civilian Executive Branch (FCEB) agencies
- had until 28 September 2026 to apply fixes
Products and systems
- Microsoft Office SharePoint
- one of the affected products named in the advisory
- SharePoint Server
- the SharePoint version Microsoft first said was affected by spoofing
- Mikrotik RouterOS
- the second affected product named in the article
- MikroTrick
- the codename for the exploit chain described in the article
How the source tells it
The article read like a routine security update, with mild urgency from the KEV listing and patch deadline, and stronger threat emphasis in the descriptions of exploitation and takeover.
- urgency the KEV listing, active-exploitation language and a fixed remediation deadline
- threat escalation descriptions of remote code execution and full administrative control