SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

Two Actively Exploited Flaws Land on CISA's KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog — one impacting Microsoft SharePoint Server and the other impacting MikroTik RouterOS — citing evidence of active exploitation in the wild. The SharePoint flaw, tracked as CVE-2026-65660 and rated CVSS 8.8, allows authenticated remote code execution, while the MikroTik flaw, CVE-2026-67279 (CVSS 6.9), lets unauthenticated attackers hijack router sessions as part of a broader exploit chain researchers have dubbed "MikroTrick." Federal civilian agencies have until September 28, 2026 to apply fixes.

Summary

The SharePoint RCE Flaw

CVE-2026-65660 was originally documented by Microsoft as a spoofing vulnerability affecting SharePoint Server. The advisory was later revised after Microsoft determined the flaw actually permits code injection, allowing an authenticated attacker to achieve remote code execution on a vulnerable server — a significant escalation from the original severity classification.

On September 25, 2026, Microsoft updated the advisory to confirm "reliable evidence of observed attacks against exploitation of this vulnerability," effectively acknowledging in-the-wild abuse. Microsoft has not disclosed the identity of the threat actor(s) involved, an attack timeline, the number or type of organizations targeted, or what attackers did after gaining code execution. Given SharePoint's role as a central document-management and collaboration hub inside enterprise and government networks, a working RCE chain — even one requiring authentication — gives attackers a high-value foothold for credential theft, internal reconnaissance, and lateral movement.

The MikroTik RouterOS Flaw and the "MikroTrick" Chain

CVE-2026-67279 affects MikroTik RouterOS, with 7.x builds confirmed vulnerable. The flaw stems from improper enforcement of a behavioral workflow that permits an unauthenticated client to open a session channel and submit exec requests to the router — something that should require prior authentication.

Researchers at CERT Polska and Bishop Fox, who analyzed the exploitation activity, found that CVE-2026-67279 is rarely used alone. Instead, it is chained with a second flaw, CVE-2026-86060, an argument injection vulnerability that allows the same unauthenticated session to supply a login request carrying an attacker-controlled policy mask. Combined, the two bugs — nicknamed "MikroTrick" — let an attacker obtain full administrative control of a RouterOS device without ever supplying a password. Only CVE-2026-67279 was added to the KEV catalog in this action, but organizations should treat CVE-2026-86060 as an integral part of the same attack path and patch against both.

MikroTik routers are widely deployed by ISPs, MSPs, and small-to-midsize networks, and are a frequent target for botnet recruitment and traffic-hijacking operations — a fully compromised, unauthenticated administrative takeover raises the stakes considerably for any exposed device.

Impact Assessment

Recommendations

For Federal Agencies (FCEB)

1. Meet the September 28, 2026 deadline — apply vendor patches for both CVE-2026-65660 and CVE-2026-67279 per BOD 22-01 requirements.
2. Also remediate CVE-2026-86060 on MikroTik devices, even though it wasn't independently added to KEV — it's a required half of the MikroTrick chain.
3. Inventory affected assets — identify all on-premises SharePoint Server instances and MikroTik RouterOS devices, especially those with any internet exposure.
4. Document remediation per agency reporting requirements to CISA.

For Security Teams and General Organizations

1. Patch SharePoint Server immediately — apply Microsoft's updated security advisory for CVE-2026-65660 across all on-premises deployments.
2. Update RouterOS to a fixed build addressing both CVE-2026-67279 and CVE-2026-86060; do not treat either fix as sufficient on its own.
3. Restrict administrative access to RouterOS devices — disable remote Winbox/API access from the internet and place management interfaces behind a VPN or bastion host.
4. Review SharePoint authentication logs for unusual authenticated sessions, especially those that immediately precede unexpected process execution or file changes.
5. Audit router configurations for unauthorized administrative accounts, firewall rule changes, or new scheduled tasks — indicators consistent with the MikroTrick technique.
6. Segment and monitor both SharePoint servers and network edge devices as high-value assets, given their central role in data access and traffic control respectively.

Key Takeaways

1. CISA added two actively exploited CVEs to its KEV catalog: CVE-2026-65660 (SharePoint, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS, CVSS 6.9).
2. The SharePoint flaw escalated in severity — Microsoft originally called it a spoofing bug before confirming it enables authenticated remote code execution, with active attacks observed as of September 25, 2026.
3. The MikroTik flaw is exploited as part of a two-bug chain ("MikroTrick") combining CVE-2026-67279 with CVE-2026-86060 to achieve unauthenticated, password-free administrative takeover.
4. Federal civilian agencies must remediate by September 28, 2026 under Binding Operational Directive 22-01.
5. Non-federal organizations should not wait — both flaws are confirmed under active exploitation and should be prioritized regardless of KEV enforcement scope.
6. Patch both halves of the MikroTik chain — fixing only CVE-2026-67279 without addressing CVE-2026-86060 leaves the exploit path viable.

Sources

• The Hacker News — SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild