CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth Bypass (CVE-2026-67279)

CISA Adds Two Actively Exploited KEVs (TL-2026-2669), also tracked as MikroTrick, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-09-26 and last reviewed 2026-09-27. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 3 CVEs (CVE-2026-65660, CVE-2026-67279, CVE-2026-86060), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2669

Threat ID
TL-2026-2669
Also known as
MikroTrick
Severity
CRITICAL
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-26
Last reviewed
2026-09-27
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, technology, telecoms
Target regions
Global, brazil, united states of america, indonesia, Czech Republic, ukraine
Detection rules
9
Indicators of compromise
24
Updates
2026-09-27 · revalidated 1× · latest source

Malware and tooling in CISA Adds Two Actively Exploited KEVs

Malware and tooling: In-memory SharePoint webshell (unnamed, XAML/ObjectDataProvider-based)

CISA added CVE-2026-65660 (Microsoft SharePoint Server code injection, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS SSH authentication-bypass, part of the 'MikroTrick' chain) to its Known Exploited Vulnerabilities catalog on September 25, 2026, citing confirmed active exploitation. SharePoint attacks chain the flaw with an anonymous ToolPane access bug to deliver encrypted in-memory webshells, while RouterOS attacks combine it with CVE-2026-86060 to seize full unauthenticated administrative control of internet-exposed routers. FCEB agencies must remediate both by September 28, 2026.

How CISA Adds Two Actively Exploited KEVs works

On September 25, 2026, CISA added two unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming evidence of active exploitation for each.

CVE-2026-65660 is a code-injection vulnerability (CWE-94, CVSS 3.1 base score 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (SharePoint Server 2013 is also affected but is unsupported since April 2023 and will not receive a fix). The root cause is a parser desynchronization in SharePoint's SafeControls filter: when the ToolPane component reconstructs 'Register' directives from web-part markup, it writes attribute values inside double quotes without escaping embedded quotes, letting an attacker splice in additional directives after the SafeControls type check has already run. This lets a low-privileged authenticated attacker register arbitrary .NET classes, then trigger code execution via XamlServices.Parse() through an ObjectDataProvider deserialization gadget, producing an in-memory web shell that avoids on-disk artifacts and registry-permission failures that block cruder deserialization payloads. Microsoft originally classified the bug as a lower-severity spoofing issue (CVSS 6.5) before updating the advisory around September 11, 2026 to reflect its true remote-code-execution impact (CVSS 8.8). Threat-intelligence firm Previdian has observed live exploit attempts chaining CVE-2026-65660 with a separate, already-patched anonymous ToolPane access bug (documented by researcher @vcslab / Dinh Ho Anh Khoa of Viettel Cyber Security) to reach pre-authentication RCE on SharePoint farms that still permit anonymous access to ToolPane pages, delivering an encrypted loader that establishes an in-memory webshell communicating outbound over an encrypted channel to attacker C2 infrastructure. Patches have been available since Microsoft's August 11, 2026 security updates (fixed builds: SE 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001).

CVE-2026-67279 (CWE-841, Improper Enforcement of Behavioral Workflow, CVSS 3.1 6.5 / CVSS 4.0 6.9) is part of a six-CVE MikroTik RouterOS disclosure batch from CERT Polska (also including CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67281, and CVE-2026-86060). It occurs because RouterOS's SSH implementation advances into the connection protocol phase after a client-requested key re-exchange (rekey) even though the client never authenticated, letting an unauthenticated remote client open a session channel and send an exec request that the server dispatches — enabling unauthorized creation, overwrite, and reconstruction of files in RouterOS's managed file namespace, including configuration and diagnostic data. On its own this is a limited-impact bug, but CERT Polska and Bishop Fox (researcher Emilio Gallegos) documented that it is being chained in the wild — under the codename 'MikroTrick' — with CVE-2026-86060, an argument-injection flaw (CWE-88) in RouterOS's SSH login helper: the helper passes the client-supplied username as a command-line argument to a legacy helper program that treats arguments beginning with a dash as file-descriptor selectors, so a username of '-2' causes the helper to read its 'trusted identity' from file descriptor 2 — which is connected to the attacker's own terminal — and install full administrative permissions with no authentication at all. Bishop Fox fully reproduced the administrative-takeover chain on RouterOS 7.x builds (the rekey bypass alone also affects 6.x, but does not yield an administrative session there without the companion bug). CERT Polska traced attack logs to at least September 2, 2026 — one day before MikroTik shipped fixed builds (6.49.21 LTS, 7.23.4 LTS, 7.24.2 Stable) on September 3, 2026 — with confirmed successful compromises from IP 82.192.72.4 and additional exploitation attempts from 103.102.31.18. Compromised devices show a newly created privileged local account named 'ops', a persistence script named 'logrotate' that silently recreates any removed attacker accounts, and a Scheduler entry named 'daily-maint' that runs the script once per day; forensic RouterOS log lines show the signature 'login failure for user -2 from <ip> via ssh; user <name> added by ssh:-2@<ip>', and objects created through the chain carry owner="0" instead of a named administrator. Shadowserver identified more than 122,500 MikroTik devices with SSH reachable from the internet, concentrated in Brazil, the United States, Indonesia, Czechia, and Ukraine. CISA separately added the companion privilege-escalation bug, CVE-2026-86060, to the KEV catalog on September 11, 2026.

No threat-actor attribution has been published for either exploitation campaign; both appear to be opportunistic, internet-scale exploitation of internet-facing enterprise/network infrastructure rather than a targeted intrusion by a named group. FCEB agencies must remediate both catalog entries by September 28, 2026 per Binding Operational Directive 26-04.

MITRE ATT&CK techniques used in TL-2026-2669

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Name or Location; T1140 Deobfuscate/Decode Files or Information; T1562.001 Impair Defenses: Disable or Modify Tools; T1620 Reflective Code Loading

Exfiltration

T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Persistence

T1053 Scheduled Task/Job; T1098 Account Manipulation; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter; T1059.008 Command and Scripting Interpreter: Network Device CLI

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Affected products and versions in CISA Adds Two Actively Exploited KEVs

  • Microsoft — SharePoint Enterprise Server 2016
    Vulnerable versions: < 16.0.5565.1001
    Fixed in: 16.0.5565.1001
  • Microsoft — SharePoint Server 2019
    Vulnerable versions: < 16.0.10417.20198
    Fixed in: 16.0.10417.20198
  • Microsoft — SharePoint Server Subscription Edition
    Vulnerable versions: < 16.0.19725.20522
    Fixed in: 16.0.19725.20522
  • Microsoft — SharePoint Server 2013
    Vulnerable versions: all versions (unsupported since April 2023, no fix planned)
  • MikroTik — RouterOS
    Vulnerable versions: 6.0.0 - 6.49.20; 7.0.0 - 7.23.3; 7.24.0 - 7.24.1
    Fixed in: 6.49.21; 7.23.4; 7.24.2

Remediation for CISA Adds Two Actively Exploited KEVs

Patches

  • Microsoft August 2026 security update for SharePoint Server 2016 / 2019 / Subscription Edition
  • MikroTik RouterOS 6.49.21 (LTS)
  • MikroTik RouterOS 7.23.4 (LTS)
  • MikroTik RouterOS 7.24.2 (Stable)

Immediate actions

  • Apply Microsoft's August 2026 SharePoint security updates immediately if not already deployed (SE 16.0.19725.20522 / 2019 16.0.10417.20198 / 2016 16.0.5565.1001)
  • Upgrade MikroTik RouterOS to 6.49.21 (LTS), 7.23.4 (LTS), or 7.24.2 (Stable) or later
  • Restrict or disable SSH, HTTP/HTTPS, and bandwidth-test services on RouterOS devices until patched; permit only trusted management networks
  • Disable anonymous access to ToolPane-reachable pages on internet-facing SharePoint farms as an interim mitigation
  • Hunt internet-facing RouterOS devices for the 'ops' local account, the 'logrotate' script, and the 'daily-maint' Scheduler entry; check for owner="0" objects and the 'login failure for user -2 ... added by ssh:-2@<ip>' log signature

Workarounds

  • SharePoint Server 2013 has no available patch (unsupported since April 2023) — isolate or decommission affected instances
  • Restrict RouterOS SSH access via firewall rules to trusted management IPs only pending patch deployment
  • Disable anonymous ToolPane access on SharePoint as an interim compensating control

Longer-term hardening

  • Deploy detection for in-memory webshells and XAML/ObjectDataProvider deserialization gadgets on SharePoint farms (AMSI, memory-scanning EDR)
  • Move network-device management interfaces (SSH, WebFig) off the public internet behind a VPN or bastion host
  • Enable and monitor RouterOS's device-mode compromise flagging (/system/device-mode/print) on all managed routers
  • Segment edge/perimeter network devices from internal management networks so a compromised router cannot pivot inward

CVEs associated with CISA Adds Two Actively Exploited KEVs

CVE-2026-65660, CVE-2026-67279, CVE-2026-86060

Weaknesses (CWE) in CISA Adds Two Actively Exploited KEVs

CWE-94, CWE-841, CWE-88

Timeline of CISA Adds Two Actively Exploited KEVs

  • Microsoft ships the August 2026 security updates fixing CVE-2026-65660, initially classified as a lower-severity spoofing issue (CVSS 6.5).
  • CERT Polska and Bishop Fox trace the earliest MikroTrick (CVE-2026-67279 + CVE-2026-86060) attack logs to this date, one day before MikroTik shipped fixes.
  • MikroTik ships RouterOS 6.49.21 (LTS), 7.23.4 (LTS), and 7.24.2 (Stable), fixing the six-CVE disclosure batch including CVE-2026-67279 and CVE-2026-86060.
  • Independent researchers publish patch-diff analysis identifying the specific SSH state-machine and login-helper changes underlying CVE-2026-67279 and CVE-2026-86060.
  • CVE-2026-67279 and CVE-2026-86060 records are formally published (20:00:55 UTC); CERT Polska's advisory states evidence indicates attackers were exploiting the RouterOS bugs before public disclosure.
  • CERT Polska publishes its initial advisory on active exploitation of the MikroTik RouterOS vulnerabilities, listing IOCs including the 'ops' account and attacker IPs.
  • Bishop Fox and CERT Polska publish deep technical analyses of the MikroTrick chain, and Shadowserver reports over 122,500 internet-exposed RouterOS SSH endpoints.
  • Microsoft updates the CVE-2026-65660 record to reflect remote code execution impact, raising the CVSS score to 8.8.
  • CISA adds the companion privilege-escalation bug CVE-2026-86060 to the KEV catalog.
  • Previdian observes real-world two-stage exploitation of CVE-2026-65660 from IP 169.150.248.21 (~12:00 UTC), delivering an AES-encrypted second-stage .NET assembly and dropping the sphealth.aspx webshell.
  • Threat-intelligence firm Previdian reports observing SharePoint exploit attempts chaining CVE-2026-65660 with an anonymous ToolPane access bug to deliver encrypted in-memory webshells.
  • CISA adds both CVE-2026-65660 and CVE-2026-67279 to the Known Exploited Vulnerabilities catalog, citing confirmed active exploitation evidence for each.
  • The Hacker News publishes combined reporting on active exploitation of both the SharePoint code-injection flaw and the MikroTrick RouterOS takeover chain, consolidating public visibility into a single narrative.
  • Deadline for FCEB agencies to remediate both CVE-2026-65660 and CVE-2026-67279 per Binding Operational Directive 26-04.

Update history for TL-2026-2669

Sources cited for CISA Adds Two Actively Exploited KEVs

More in vulnerability

Detection coverage for TL-2026-2669

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2669 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats