### CISA Flags Critical SharePoint and MikroTik Flaws **CISA** recently updated its **Known Exploited Vulnerabilities (KEV)** catalog, highlighting two security flaws that are actively being leveraged by malicious actors. The vulnerabilities impact widely used platforms: **Microsoft Office SharePoint** and **MikroTik RouterOS**, underscoring the broad attack surface faced by IT security professionals.  ### The Vulnerabilities Under Scrutiny The two vulnerabilities added to the KEV catalog are: * **CVE-2026-65660** (CVSS score: 8.8): A code injection vulnerability within **Microsoft Office SharePoint**. This flaw enables an authorized attacker to execute arbitrary code over a network, potentially leading to full system compromise. * **CVE-2026-67279** (CVSS score: 6.9): An improper enforcement of behavioral workflow vulnerability in **MikroTik RouterOS**. This allows an unauthenticated client to open a session channel and send an `exec` request, a critical step towards unauthorized access. ### SharePoint's Evolving Threat Landscape **CVE-2026-65660** was initially described by **Microsoft** as a spoofing vulnerability affecting **SharePoint Server**. However, the tech giant has since updated its advisory, confirming that the flaw can be abused to achieve remote code execution. **Microsoft** noted that as of September 25, 2026, it had "reliable evidence of observed attacks against exploitation of this vulnerability." While **Microsoft** has confirmed active exploitation, details regarding the attackers, the scale of the attacks, or the impact on targeted organizations remain undisclosed. ### The MikroTrick Exploit Chain **CVE-2026-67279**, impacting **MikroTik RouterOS**, is part of an exploit chain dubbed **MikroTrick**. This chain, which also includes **CVE-2026-86060** (an argument injection flaw in the RouterOS login process), enables attackers to gain full administrative control over internet-exposed susceptible routers without requiring a password. **CERT Polska** elaborated on the exploit, stating, "Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console. **CVE-2026-67279** allowed an unauthenticated client to create a session channel, while **CVE-2026-86060** allowed it to supply login with an attacker-controlled policy mask." Security firm **Bishop Fox** has successfully reproduced the complete administrative takeover on vulnerable RouterOS 7.x builds. Emilio Gallegos, a security researcher at **Bishop Fox**, explained, "**MikroTrick** combines two failures at different trust boundaries. The first allows an unauthenticated connection to reach functionality that RouterOS should expose only after login. The second causes the login process to treat data from that connection as a trusted administrative identity." This highlights a significant design risk where features intended for trusted local callers become remote attack surfaces when authentication state is compromised upstream. ### Urgent Action Required for Federal Agencies It's important to note that **CISA** previously added **CVE-2026-86060** to its KEV catalog on September 11, 2026. Federal Civilian Executive Branch (**FCEB**) agencies have a deadline of September 28, 2026, to apply the necessary patches for these critical vulnerabilities. Given the active exploitation, all organizations, not just federal agencies, are strongly advised to prioritize patching these flaws immediately to mitigate potential risks.