CISA Adds Two Actively Exploited Flaws to KEV Catalog:…

On September 25, 2026, CISA added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint Server (CVSS 8.8), and CVE-2026-67279, an SSH authentication bypass in MikroTik RouterOS (CVSS 6.9), to its Known Exploited Vulnerabilities Catalog. Federal Civilian Executive Branch agencies must apply patches by September 28, 2026. While the deadline is not binding for private organizations, confirmed exploitation and functional attack chains make urgent risk assessment essential.

{"main_topic":"cybersecurity","topics":["cve","vulnerabilita","patch","exploit","microsoft","mikrotik"]}

On September 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited flaws to its Known Exploited Vulnerabilities Catalog: CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint Server with a CVSS score of 8.8, and CVE-2026-67279, an SSH authentication bypass in MikroTik RouterOS with a CVSS of 6.9. U.S. federal agencies belonging to the Federal Civilian Executive Branch (FCEB) must apply patches by September 28, 2026. For private organizations the deadline is not mandatory, but the convergence of confirmed exploitation and functional attack chains makes urgent risk assessment essential.

Key Takeaways

CISA cataloged CVE-2026-65660 (SharePoint, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS, CVSS 6.9) as actively exploited vulnerabilities on September 25, 2026.
The SharePoint flaw allows an authenticated attacker with limited privileges to execute arbitrary code remotely; it affects Server 2016, 2019, and Subscription Edition.
The MikroTik defect allows an unauthenticated client to open an SSH session channel and send exec requests, completely bypassing the authentication flow.
The chain dubbed "MikroTrick," documented by CERT Polska, combines CVE-2026-67279 with CVE-2026-86060 to achieve full administrative access without credentials.

SharePoint On-Premises: Internal Trust as an Attack Vector

CVE-2026-65660 exploits a trust boundary typical of complex enterprise architectures: the attacker is already inside the perimeter, authenticated but with minimal privileges, and from there escalates to remote code execution. According to the official CVE-2026-65660 record, the CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network access, low attack complexity, low privileges required, no user interaction needed. This combination makes it exploitable at scale using pivoting and lateral movement techniques once a single account is compromised.

Affected versions are SharePoint Server 2016, 2019, and Subscription Edition. Patches are available per the CVE.org record, but on-premises deployment requires maintenance planning that federal agencies must complete in just three days. CISA has activated the forensic triage flag for this vulnerability under Binding Operational Directive 26-04: agencies must document and analyze potential indicators of compromise, not merely install the update.

The pattern is recurring. Since July 2026, CISA has added six SharePoint-related CVEs to the KEV catalog, a cadence that signals an attack surface under systemic pressure and an on-premises instance lifecycle management that cannot keep pace with the offensive maturity of threat actors.

MikroTik: When a CVSS 6.9 Becomes Critical

CVE-2026-67279 is classified as Improper Enforcement of Behavioral Workflow with a CVSS of 6.9. The medium-high score does not capture the real impact: the vulnerability allows an unauthenticated attacker to open an SSH session channel and send exec requests, breaking the protocol's state machine at the implementation level. In practice, authentication is bypassed not with stolen credentials, but with a structural violation of the SSH handshake.

CERT Polska confirmed active in-the-wild exploitation with documented successful attacks starting September 2, 2026. The name "MikroTrick" identifies the specific chaining of CVE-2026-67279 with CVE-2026-86060: the first bypass opens the channel, the second — per the CISA KEV catalog — elevates the result to "unauthenticated exploitation" with resulting full administrative access. None of the available sources detail CVE-2026-86060 in terms of mechanism or affected products, but CISA confirms its chainability in the catalog record.

"CERT Polska confirmed that the flaw is being actively exploited in the wild and that, when chained with CVE-2026-86060, it can lead to full administrative access without authentication"

RouterOS devices exposed directly to the internet — a common configuration among network infrastructure providers, WISPs, and small operators — are active targets. The CISA record does not specify the number of compromised systems, but the combination of exposed protocol and authentication bypass makes target discovery trivial via scanning engines.

BOD 26-04 and the Operational Cost of Response

The difference in treatment between the two vulnerabilities within the regulatory framework is significant. CVE-2026-65660 (SharePoint) requires mandatory forensic triage: agencies must verify whether they have been compromised, not just patch. CVE-2026-67279 (MikroTik) does not trigger this requirement in the KEV catalog, despite confirmed exploitation. This discrepancy reflects a prioritization logic based on target system complexity and log visibility, not just technical severity.

BleepingComputer confirmed that the September 28, 2026 deadline for SharePoint and MikroTik is distinct from the September 27 deadline set for other CVEs added in the same catalog update. CISA deemed an additional day necessary for these two flaws, likely due to the complexity of update paths — SharePoint requires compatibility testing with custom farms, MikroTik patches distributed across geographically dispersed hardware.

What to Do Now

For SharePoint Server 2016, 2019, and Subscription Edition: verify applicability of patches indicated in the CVE-2026-65660 record and plan installation by September 28, 2026 for government environments, with elevated urgency for all others.
For MikroTik RouterOS: identify devices with SSH service exposed to the internet and assess update availability; the source does not specify current patches but exploitation is documented from September 2, 2026.
Activate mandatory forensic triage for CVE-2026-65660 in organizations subject to BOD 26-04, with log scanning and indicators of compromise predating the patch.
Assess network segmentation to isolate on-premises SharePoint instances and MikroTik devices, limiting direct exposure of administrative protocols to the internet.

The Lesson of the Wrong Score

The CVE-2026-67279 case demonstrates the limits of CVSS as a sole measure of risk. A 6.9 that enables authentication bypass on an exposed protocol, chained with a second flaw not yet publicly detailed, produces an operational impact exceeding many isolated "critical" vulnerabilities. CISA manages this gap with the KEV catalog, which overrides theoretical severity with exploitation evidence. Organizations filtering for CVSS ≥ 7.0 risk missing the MikroTrick chain.

For SharePoint, the problem is cumulative: six CVEs in five months indicate that on-premises maintenance is no longer sustainable at the pace of the offensive. The Subscription Edition, theoretically the modernization path, appears on the same list as legacy editions. Cloud migration is not discussed in the sources, but the operational pressure is quantifiable: every KEV addition accelerates the patching cycle and compliance costs.

September 28, 2026 is a government deadline, but the attackers' calendar recognizes no distinction between public and private.

FAQ

Why does CVE-2026-67279 have a CVSS of 6.9 if it allows unauthenticated access?

The score reflects the isolated vector: opening a session channel and exec request with limited impact on confidentiality and integrity (C:L/I:L) and no availability impact (A:N). The full impact emerges only in the chain with CVE-2026-86060, which the base CVSS does not capture.

Has CISA confirmed exploitation of CVE-2026-65660?

The KEV catalog reports "Unknown" for the ransomware campaign and sources do not specify whether the addition is based on directly observed exploitation or elevated risk. BOD 26-04 nonetheless requires forensic triage, indicating maximum operational caution.

Is a patch available for CVE-2026-67279?

Sources do not explicitly specify patches for MikroTik RouterOS; the CVE-2026-67279 record is not detailed in available sources like the SharePoint one. Urgency stems from confirmed exploitation, not from certainty of immediate mitigation.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter