Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows - CVE-2026-65660 (CVSS score: 8.8) - A code injection vulnerability in Microsoft Office SharePoint
Analysis Summary
# Vulnerability: Microsoft SharePoint Code Injection and MikroTik RouterOS Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-65660 | CVE-2026-67279
- **CVSS Score:** 8.8 (High) | 6.9 (Medium)
- **CWE:** Code Injection | Improper Enforcement of Behavioral Workflow
## Affected Systems
- **Products:**
- Microsoft Office SharePoint Server
- MikroTik RouterOS
- **Versions:**
- SharePoint: Specific versions not listed, but impacts SharePoint Server (originally classified as a spoofing flaw).
- MikroTik: RouterOS version 7.x builds.
- **Configurations:**
- For MikroTik: Internet-exposed susceptible routers.
- For SharePoint: Authorized attacker access (authenticated).
## Vulnerability Description
- **CVE-2026-65660 (SharePoint):** A code injection vulnerability. Originally misclassified by Microsoft as a spoofing flaw, it was later upgraded to Remote Code Execution (RCE). An attacker with authorized access can inject and execute malicious code.
- **CVE-2026-67279 (MikroTik):** Part of the "MikroTrick" exploit chain. It allows an unauthenticated client to bypass security boundaries to create a session channel and send an `exec` request. When chained with CVE-2026-86060, it allows the login process to treat unauthenticated data as a trusted administrative identity.
## Exploitation
- **Status:** Exploited in the wild (Both added to CISA KEV catalog).
- **Complexity:**
- SharePoint: Not specified.
- MikroTik: Low (Reproduced by Bishop Fox and CERT Polska).
- **Attack Vector:**
- SharePoint: Network.
- MikroTik: Network (Unauthenticated).
## Impact
- **Confidentiality:** High (Full administrative takeover for MikroTik; RCE for SharePoint).
- **Integrity:** High.
- **Availability:** High.
## Remediation
### Patches
- **Microsoft SharePoint:** Users should refer to the August 2026 security update review and apply the latest patches via the MSRC update guide.
- **MikroTik:** Update RouterOS to the latest stable version where these vulnerabilities are addressed.
### Workarounds
- **MikroTik:** Disable remote administrative access (WinBox/WebFig) from the public internet; restrict access to trusted IP addresses only.
- **General:** CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply fixes by September 28, 2026.
## Detection
- **Indicators of Compromise:**
- Unexpected session channels created by unauthenticated IPs on MikroTik devices.
- Use of the "MikroTrick" exploit chain (CVE-2026-67279 + CVE-2026-86060).
- **Detection methods and tools:**
- Monitor SharePoint logs for unauthorized code execution attempts or unusual service behavior.
- Audit MikroTik login processes for attacker-controlled policy masks.
## References
- **Vendor advisories:**
- hxxps://msrc[.]microsoft[.]com/update-guide/en-US/vulnerability/CVE-2026-65660
- hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Relevant links:**
- hxxps://cert[.]pl/en/posts/2026/09/mikrotrick-technical-analysis/
- hxxps://bishopfox[.]com/blog/mikrotrick-inside-the-routeros-takeover-chain
- hxxps://thehackernews[.]com/2026/09/sharepoint-rce-and-mikrotik-routeros.html