U.S. cybersecurity authorities have added two serious vulnerabilities—one in Microsoft SharePoint, one in MikroTik RouterOS—to their Known Exploited Vulnerabilities list after confirming they are being used in real-world attacks. Those running affected versions need to take immediate action.
What’s at Risk
The first flaw, tracked as CVE-2026-65660 (CVSS 8.8), pertains to Microsoft Office SharePoint. What was initially classified as a spoofing vulnerability has since been re-evaluated: attackers with privileges can remotely execute arbitrary code over a network, placing organizations at risk of full system compromise. Reliable evidence of observed attacks exists as of September 25, 2026.
The second issue, CVE-2026-67279 (CVSS 6.9), impacts MikroTik RouterOS. This weakness allows an unauthenticated client to open a session channel and issue exec commands—if combined with another flaw, the results can be catastrophic. That companion flaw, CVE-2026-86060, involves argument injection during the login process.
The MikroTrick Chain & Administrative Takeover
By chaining CVE-2026-67279 with CVE-2026-86060—dubbed the “MikroTrick” exploit—attackers can gain complete administrative access to vulnerable routers without any valid credentials. Research from CERT Polska confirms the combo provides full control of internet-exposed devices. Meanwhile, independent security firm Bishop Fox reproduced a full admin console takeover on RouterOS 7.x builds.
The design flaw here lies in how RouterOS mishandles trust boundaries. One vulnerability lets unauthenticated users reach functionality that should only be available after login, while the other misinterprets that user’s data as holding administrative privileges. The result is a dangerous escalation of privilege without intervention.
What You Need to Do
- System administrators using Microsoft SharePoint should apply the patch for CVE-2026-65660 immediately, especially since this vulnerability has moved from a lower-risk spoofing designation to a critical remote code execution threat.
- MikroTik users should patch both CVE-2026-67279 and CVE-2026-86060. These vulnerabilities were added to the KEV catalog on separate dates, and being proactive is your only safe bet.
- Federal agencies must act fast: the fix-related deadline for Federal Civilian Executive Branch entities for CVE-2026-86060 is September 28, 2026.
Both Microsoft and MikroTik have rolled out fixes. Check vendor advisories for versions in use and test patches in a controlled environment before broad deployment. Monitor logs for unexpected session channel openings or exec requests—these are indicators of abuse.
Tracking these incidents helps clarify attacker patterns: SharePoint flaws are often exploited from internal access, while MikroTrick demonstrates how router firewalls and exposed management interfaces continue to be weak links.
These developments underscore a broader trend: vulnerabilities that were once considered minor or limited can evolve into full-blown infrastructure threats. SharePoint’s flaw moved from spoofing to remote code execution, and MikroTrick shows how chaining makes bigger downsides for platforms like RouterOS. The lesson is clear for today’s security teams—don’t underplay dependencies between components or assume that authentication boundaries are impermeable. Vigilance and patching aren’t optional; they’re essential.
