CISA Flags Actively Exploited SharePoint and MikroTik RouterOS Flaws

The U.S. Cybersecurity and Infrastructure Security Agency added two more vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, citing confirmed in-the-wild attacks against both Microsoft SharePoint and MikroTik's RouterOS.

CVE-2026-65660 is a code-injection flaw in SharePoint Server (2016, 2019, and Subscription Edition) carrying an 8.8 CVSS score, letting an authenticated but low-privileged attacker execute arbitrary code remotely. The second, CVE-2026-67279, is a lower-severity (6.9) but still actively abused flaw in MikroTik RouterOS that lets an unauthenticated client open a session channel and issue commands; CERT Polska says it has tracked exploitation of internet-exposed RouterOS devices, dubbed the "MikroTrick" chain, back to at least September 2, 2026.

Federal civilian agencies have been ordered to patch both flaws by September 28, 2026. Because RouterOS devices are widely deployed by small ISPs and home-office routers alike, security researchers are warning that unpatched units could keep feeding into these attack chains well past the federal deadline.

Photo via Wikimedia Commons, © Santeri Viinamäki, licensed under CC BY-SA 4.0.