Security AffairsPierluigi Paganini
CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw
Part of the CVE-2026-65660 story · since 25 Sep
- Fri 25 Sep, 08:23 UTC. SecurityOnline, first report. Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells. Cites a CVE in CISA KEV.
- Fri 25 Sep, 16:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 17:00 UTC. CISA. CISA Flags Actively Exploited SharePoint and MikroTik Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 21:31 UTC. Security Affairs, its first report on the story. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw. Cites a CVE in CISA KEV. This article, 4th of 5.
- Sun 27 Sep, 09:46 UTC. SecurityWeek, its first report on the story. Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells. Cites a CVE in CISA KEV.
The US Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 25 September 2026: CVE-2026-65660, a Microsoft SharePoint code-injection flaw with a CVSS score of 8.8, and CVE-2026-67279, a MikroTik RouterOS vulnerability involving improper enforcement of a behavioural workflow, rated 6.9.
CVE-2026-65660 affects SharePoint Server 2016, 2019 and Subscription Edition. An authenticated, low-privileged attacker could use it to execute arbitrary code remotely. The article does not say that this flaw is being exploited, but CISA’s KEV listing identifies vulnerabilities known to have been exploited.
CVE-2026-67279 affects the RouterOS SSH protocol and can allow an unauthenticated attacker to bypass normal authentication, open a session channel and execute commands, potentially creating or changing files on the device. CERT Polska confirmed exploitation of internet-exposed RouterOS devices from at least 2 September 2026, using the MikroTrick attack chain. When combined with CVE-2026-86060, the flaw can provide full administrative access without authentication.
Under Binding Operational Directive 22-01, US federal agencies must address the vulnerabilities by 28 September 2026. Private organisations are also advised to review the KEV catalogue and remediate affected systems.
How the story developed
5 articles from 4 outlets since 25 Sep. Quiet since 27 Sep. This was the 4th report, 13 hours after the first.
- Fri 25 Sep, 08:23 UTC. SecurityOnline, first report. Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells. Cites a CVE in CISA KEV.
- Fri 25 Sep, 16:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 17:00 UTC. CISA. CISA Flags Actively Exploited SharePoint and MikroTik Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 21:31 UTC. Security Affairs, its first report on the story. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw. Cites a CVE in CISA KEV. This article, 4th of 5.
- Sun 27 Sep, 09:46 UTC. SecurityWeek, its first report on the story. Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 5 articles as a listHide the list
- Fri 25 SepDay 04
- Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells08:23 · SecurityOnline · First report · Known exploited CVE
- CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw16:01 · CISA · official · CISA alert · Known exploited CVE
- CISA Flags Actively Exploited SharePoint and MikroTik Flaws17:00 · CISA · official · Known exploited CVE
- CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw21:31 · Security Affairs · Known exploited CVE · This article, 4th of 5
Quiet for 2 days
Sun 27 SepDay 21- Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells09:46 · SecurityWeek · Known exploited CVE