CISA adds actively exploited SharePoint and MikroTik RouterOS flaws to its Known Exploited Vulnerabilities catalog

TLDR

• CISA added a Microsoft SharePoint flaw (CVE-2026-65660) and a MikroTik RouterOS flaw (CVE-2026-67279) to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
• Microsoft originally described the SharePoint bug as a spoofing issue but updated its advisory to confirm it allows remote code execution, with reliable evidence of attacks observed as of 25 September.
• The MikroTik flaw, dubbed "MikroTrick," chains with a second bug to give an unauthenticated attacker full administrative takeover of vulnerable RouterOS routers, with no password needed.
• Federal civilian agencies must apply fixes for the chained MikroTik bug by 28 September 2026.

Microsoft updated its advisory for CVE-2026-65660, a SharePoint flaw it had originally classified as a spoofing vulnerability, to confirm it actually allows an authorised attacker to execute code over a network, rating it CVSS 8.8.¹ Microsoft said that as of 25 September it had "reliable evidence of observed attacks" exploiting the flaw, though it has not disclosed the attacker's identity, how many organisations were targeted, or what happened after compromise.¹

Separately, researchers at CERT Polska and Bishop Fox detailed a MikroTik RouterOS attack, nicknamed "MikroTrick," that chains CVE-2026-67279 with a second flaw, CVE-2026-86060, to let an unauthenticated client open a session channel and supply a login request with an attacker-controlled policy mask, resulting in full administrative access to the router's console without a password.¹ Bishop Fox reproduced the complete takeover on vulnerable RouterOS 7.x builds, and researcher Emilio Gallegos described the bug as combining two failures at different trust boundaries, where a feature meant to be locally trusted becomes remotely exploitable once an upstream component loses track of authentication state.¹ CVE-2026-86060 was already added to CISA's KEV catalog on 11 September; CVE-2026-67279 and the SharePoint flaw were added this week, with federal civilian agencies required to patch the MikroTik chain by 28 September 2026.¹

Why it matters: both flaws sit in infrastructure many organisations treat as already hardened, an enterprise collaboration platform and a router operating system, so a change in Microsoft's own severity assessment and a full unauthenticated router takeover both warrant priority patching well ahead of the federal deadline.