CISA adds critical SharePoint and RouterOS flaws to exploited vulnerabilities list
Federal agencies must patch these actively exploited vulnerabilities by September 2026
1Critical vulnerabilities catalogued
CISA added three severe vulnerabilities to its Known Exploited Vulnerabilities catalog, including a SharePoint code injection flaw (CVE-2026-65660, CVSS 8.8) and a RouterOS authentication bypass (CVE-2026-67279, CVSS 6.9). These affect SharePoint Server 2016/2019/Subscription Edition and MikroTik RouterOS devices. The catalog mandates federal agencies to address listed vulnerabilities by specified deadlines to mitigate attack risks.
2SharePoint attack vector
The SharePoint vulnerability allows authenticated low-privilege attackers to execute arbitrary code remotely. This server-side code injection could enable complete system compromise. Microsoft's enterprise collaboration platform is widely used in government and corporate environments, making this a high-value target. The vulnerability's 8.8 CVSS score reflects its combination of high impact and relatively low attack complexity.
3RouterOS authentication flaw
The MikroTik RouterOS vulnerability permits unauthenticated attackers to bypass normal SSH authentication, open session channels, and execute commands. This could allow file creation/modification on affected networking devices. CERT Polska confirmed active exploitation of this flaw since at least September 2026, particularly when chained with another vulnerability (CVE-2026-86060) to gain full administrative access.
4Federal compliance requirements
Under Binding Operational Directive (BOD) 22-01, federal agencies must remediate these vulnerabilities by September 28, 2026. The directive aims to reduce risks from known exploited vulnerabilities across government networks. While mandatory for federal agencies, CISA also recommends private organizations review and address these vulnerabilities in their infrastructure.
5Exploitation evidence
CERT Polska reported successful attacks against internet-exposed RouterOS devices using what they term the 'MikroTrick chain' - combining multiple vulnerabilities for complete system compromise. The confirmed exploitation timeline demonstrates these vulnerabilities present immediate risks, particularly for organizations using affected MikroTik networking equipment in perimeter security roles.
6Impact assessment
The SharePoint vulnerability poses significant risk to organizations using the platform for document management and collaboration. The RouterOS flaw threatens network infrastructure security, especially for ISPs and enterprises using MikroTik devices. Both vulnerabilities enable remote code execution, among the most severe security issues, potentially leading to data breaches or network compromise.
7Remediation timeline
Federal agencies have until September 28, 2026 to implement fixes. This deadline reflects the vulnerabilities' active exploitation status. Organizations running affected SharePoint or RouterOS versions should prioritize patching, with particular urgency for internet-facing systems. The binding directive ensures federal networks will be protected, but private sector adoption remains voluntary.
8Broader security implications
These additions to the KEV catalog highlight ongoing challenges in securing widely deployed enterprise and networking software. The active exploitation demonstrates how quickly vulnerabilities are weaponized. The catalog serves as a prioritized list of vulnerabilities requiring immediate attention, with federal compliance creating a benchmark for private sector security practices.