CISA Flags SharePoint and MikroTik RouterOS Flaws as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two entries to its Known Exploited Vulnerabilities (KEV) catalog. Both — in Microsoft SharePoint and MikroTik RouterOS — come with evidence of real-world attacks.

SharePoint: from 'spoofing' to remote code execution

The first flaw, CVE-2026-65660 (CVSS 8.8), is a code injection vulnerability in Microsoft Office SharePoint. It lets an authorized attacker execute code over a network.

Tellingly, Microsoft originally described it as a spoofing vulnerability. The company later revised its advisory, acknowledging that the bug could be abused for remote code execution. As of September 25, 2026, the vendor said it had reliable evidence of observed attacks exploiting the flaw.

Microsoft did not disclose who was behind the attacks, when they began, how many organizations were targeted, how many were compromised, or what the attackers did once inside the vulnerable service.

MikroTik: the MikroTrick chain and takeover without a password

The second entry, CVE-2026-67279 (CVSS 6.9), stems from improper enforcement of behavioral workflow in RouterOS. It allows an unauthenticated client to open a session channel and send an exec request.

The flaw is chained with CVE-2026-86060, an argument injection bug in the RouterOS login process. Together they form an exploit dubbed MikroTrick, which, according to Poland's CERT Polska, grants full administrative control over internet-exposed routers without a password.

"Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console," the Polish agency said. CVE-2026-67279 lets an unauthenticated client create a session channel, while CVE-2026-86060 lets it supply login with an attacker-controlled policy mask.

Bishop Fox independently reproduced the complete administrative takeover on vulnerable RouterOS 7.x builds. As researcher Emilio Gallegos put it, MikroTrick combines two failures at different trust boundaries: the first lets an unauthenticated connection reach functionality that should be available only after login, while the second makes the login process treat that connection's data as a trusted administrative identity.

He notes the case exposes a design risk in privileged software: a feature meant only for trusted local callers becomes a remote attack surface when an upstream component loses track of authentication state.

CVE-2026-86060 was added to the KEV catalog back on September 11, 2026. U.S. Federal Civilian Executive Branch agencies have until September 28, 2026, to apply the fixes.

Source: The Hacker News