SharePoint RCE and MikroTik RouterOS flaws face active exploitation

CISA added a SharePoint code-injection flaw and two linked MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog. Attackers can use the RouterOS chain to gain administrative control without a password.

The U.S. Cybersecurity and Infrastructure Security Agency added two vulnerabilities affecting Microsoft SharePoint and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog Friday after researchers and vendors documented attacks in the wild.

CISA listed Microsoft SharePoint flaw CVE-2026-65660 and MikroTik RouterOS flaw CVE-2026-67279. Federal Civilian Executive Branch agencies must apply available fixes by Sept. 28, 2026.

SharePoint flaw can lead to remote code execution

CVE-2026-65660 carries a CVSS score of 8.8. The flaw lets an authorized attacker inject code into a SharePoint server and execute it across a network.

Microsoft first described the issue as a spoofing vulnerability in its security update guide . The company later changed the advisory after investigators confirmed the remote-code-execution risk.

Microsoft said it had reliable evidence of attacks exploiting the flaw as of Sept. 25. The company has not identified the attackers, disclosed when the campaign began or described the actions that followed successful exploitation.

SharePoint administrators should review Microsoft’s advisory for affected server versions and install the related security updates. Teams should also inspect authentication records, unusual process activity, new administrator accounts and changes to SharePoint configuration after patching.

MikroTik chain enables router takeover

CVE-2026-67279 affects the enforcement of behavioral workflows in RouterOS. An unauthenticated client can use the flaw to open a session channel and send an execution request.

Attackers can pair it with CVE-2026-86060, an argument-injection flaw in the RouterOS login process. CERT Polska named the exploit chain MikroTrick and said the pair can give an attacker access to the administrative console without a password.

The first flaw lets an unauthenticated connection create a session channel. The second lets the attacker pass a policy mask that RouterOS treats as an administrative identity, according to CERT Polska.

Bishop Fox reproduced the takeover on vulnerable RouterOS 7.x builds. Researcher Emilio Gallegos said the chain crosses two trust boundaries: one flaw exposes a function meant for trusted callers, while the other lets attacker-controlled login data gain administrative treatment.

What router administrators should check

Administrators should identify internet-facing MikroTik routers, record their RouterOS versions and apply MikroTik’s security updates. They should restrict management access to trusted networks or a VPN and remove direct exposure from the public internet where possible.

After patching, review router logs for unexpected session creation, login attempts, new users, policy changes, firewall edits, scheduled tasks and configuration exports. Rotate administrator passwords and other credentials if an exposed router handled them.

Organizations should also compare current router configurations with known-good copies. Attackers who gain administrative access can change firewall rules, redirect traffic, create persistence or use a router as a foothold into internal networks.

CISA added CVE-2026-86060 to the KEV catalog Sept. 11. Its addition of CVE-2026-67279 places both parts of the MikroTrick chain on the federal remediation list, while the SharePoint listing signals an active risk for organizations that expose the collaboration platform to network users.

Administrators can track new federal remediation deadlines through CISA’s KEV catalog , consult Microsoft’s security update guide for SharePoint details and follow advisories from CERT Polska and MikroTik .

Please log in or register to join the discussion