That blunt assessment underpins two separate additions this week to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog: a Microsoft SharePoint flaw now tied to remote code execution and a pair of Mikrotik RouterOS weaknesses that have been chained into a passwordless administrative takeover dubbed "MikroTrick." CISA moved both entries into the KEV list after observing evidence of exploitation in the wild, and federal agencies face an imminent patching deadline.
CVE-2026-65660: SharePoint code-injection and observed attacks
CVE-2026-65660 (CVSS 8.8) is described as a code injection vulnerability in Microsoft Office SharePoint that "allows an authorized attacker to execute code over a network." Microsoft initially characterized the issue as a spoofing vulnerability in SharePoint Server but later updated its advisory to state that the bug "could be abused to obtain remote code execution." Microsoft also stated that "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability." The company has not disclosed who was behind those exploitation efforts, when they began, how many organizations were targeted or successfully breached, or what attackers did once they accessed vulnerable services.
CVE-2026-67279 and CVE-2026-86060: MikroTrick gives unauthenticated admin access
The other KEV addition, CVE-2026-67279 (CVSS 6.9), is an "improper enforcement of behavioral workflow" vulnerability in Mikrotik RouterOS that could allow an unauthenticated client to open a session channel and send an exec request. CERT Polska reported that attackers have chained this flaw with CVE-2026-86060, an argument injection vulnerability in the RouterOS login process, as part of an exploit called MikroTrick.
CERT Polska said the exploit chain "has been employed to take full administrative control of internet-exposed susceptible routers without the need for a password." In its explanation, the Polish agency added that "CVE-2026-67279 allowed an unauthenticated client to create a session channel, while CVE-2026-86060 allowed it to supply login with an attacker-controlled policy mask." Independent analysis by Bishop Fox confirmed the research, reproducing the complete administrative takeover on vulnerable RouterOS 7.x builds.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleResearchers on MikroTrick: two trust-boundary failures
Security researcher Emilio Gallegos described the chain succinctly: "MikroTrick combines two failures at different trust boundaries." He said the first failure "allows an unauthenticated connection to reach functionality that RouterOS should expose only after login," while the second "causes the login process to treat data from that connection as a trusted administrative identity." Gallegos added that the exploit "exposes a design risk in privileged software: a feature intended only for trusted local callers becomes a remote attack surface when an upstream component loses track of authentication state."
CISA actions and the Federal Civilian Executive Branch deadline
CISA added CVE-2026-86060 to its KEV catalog on September 11, 2026, and this week's additions bring the total impact of the MikroTrick chain squarely into the KEV program. The agency's KEV listing triggers mandatory timelines for federal agencies: Federal Civilian Executive Branch (FCEB) organizations have until September 28, 2026, to apply the necessary fixes for vulnerabilities on the KEV list. The inclusion of both SharePoint and RouterOS flaws signals CISA's determination that the vulnerabilities are being actively exploited and warrant prioritized mitigation.
What this means for security teams, FCEB agencies, and MikroTik device owners
- Security teams and technologists: The SharePoint entry was updated from spoofing to remote code execution and Microsoft reported "reliable evidence of observed attacks" as of 9/25/2026, making rapid assessment and mitigation of CVE-2026-65660 a priority for environments running vulnerable SharePoint Server builds.
- Federal Civilian Executive Branch agencies: With a CISA-mandated KEV deadline of September 28, 2026, FCEB organizations must treat the added entries as time-sensitive compliance items and apply required fixes within the specified window.
- MikroTik device owners and enterprises with internet-exposed RouterOS gear: CERT Polska and Bishop Fox research shows CVE-2026-67279 chained with CVE-2026-86060 can produce a full, unauthenticated administrative takeover—an outcome affecting routers reachable from the internet and particularly noted on vulnerable RouterOS 7.x builds.
The public record in this case is sharply procedural: vendors and CERTs have described vulnerabilities, public researchers have reproduced exploit chains, and CISA has placed the items on the KEV list, triggering mandatory action for federal agencies. Microsoft has confirmed observed attacks against the SharePoint flaw but has not released attribution, scope, or post-exploitation details. CERT Polska and Bishop Fox have shown the MikroTrick chain can deliver complete administrative control without credentials. For defenders and owners of affected software, the proximate facts—CVEs, scores, observed exploitation, and a federal patching deadline—are now the operational realities they must address.
Source: thehackernews.com — SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
