CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth Bypass (CVE-2026-67279)

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2669 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SharePoint w3wp.exe Spawning Script Interpreter — Possible In-Memory Webshell (CVE-2026-65660)

Detects the SharePoint application-pool worker process (w3wp.exe) spawning a script interpreter/build tool, or command lines referencing XamlServices/ObjectDataProvider deserialization gadgets — consistent with the encrypted in-memory webshell delivered by the CVE-2026-65660 exploit chain, which uses reflective code loading to avoid on-disk artifacts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1620, T1027, T1059
• Data sources: sysmon, windows_security
• Severity: critical
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe"
| where match(ParentCommandLine, "(?i)SharePoint|MSSharePoint|WSS_")
| where match(Image, "(?i)\\\\(cmd|powershell|powershell_ise|csc|msbuild|cscript|wscript)\.exe$") OR match(CommandLine, "(?i)FromBase64String|IEX|XamlServices|ObjectDataProvider")
| stats count min(_time) as first_seen values(CommandLine) as commands by ComputerName, User, Image, ParentImage
| where count>=1

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("SharePoint", "MSSharePoint", "WSS_")
| where FileName in~ ("cmd.exe","powershell.exe","csc.exe","msbuild.exe","cscript.exe","wscript.exe")
    or ProcessCommandLine has_any ("FromBase64String", "IEX", "XamlServices", "ObjectDataProvider")
| summarize Count=count(), Commands=make_set(ProcessCommandLine) by DeviceName, AccountName, FileName

Sigma

title: SharePoint w3wp.exe Spawning Script Interpreter — Possible In-Memory Webshell (CVE-2026-65660)
id: 8f3a2e1c-4b6d-4a2f-9c3e-1a2b3c4d5e04
status: experimental
description: Detects the SharePoint application-pool worker process (w3wp.exe) spawning a script interpreter or build tool, or command lines referencing XamlServices/ObjectDataProvider deserialization gadgets — consistent with the encrypted in-memory webshell delivered by the CVE-2026-65660 exploit chain.
references:
    - https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.execution
    - attack.t1505.003
    - attack.t1620
    - attack.t1027
    - attack.t1059
    - cve.2026.65660
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains:
            - 'SharePoint'
            - 'MSSharePoint'
            - 'WSS_'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\csc.exe'
            - '\msbuild.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    selection_gadget:
        CommandLine|contains:
            - 'FromBase64String'
            - 'XamlServices'
            - 'ObjectDataProvider'
    condition: selection_parent and (selection_child or selection_gadget)
falsepositives:
    - SharePoint farm administration or custom web-part deployment scripts that legitimately shell out from the app pool (rare in hardened environments)
level: critical

Known false positives:

• SharePoint farm administration or custom web-part deployment scripts that legitimately shell out from the app pool

Tuning notes: Allowlist known SharePoint maintenance scripts/service accounts that legitimately spawn PowerShell from w3wp.exe; weight the gadget-keyword match (XamlServices/ObjectDataProvider) higher than the bare interpreter-spawn match since it is far more exploit-specific.

• 🔒 MikroTik RouterOS SSH Rekey Without Prior Authentication (CVE-2026-67279) · unlock with TL Creds
• 🔒 MikroTik RouterOS Unauthorized Local Admin Account 'ops' Created via MikroTrick Chain · unlock with TL Creds
• 🔒 Inbound Connection From Known MikroTrick Attacker Infrastructure ([indicator] / [indicator]) · unlock with TL Creds
• 🔒 MikroTik RouterOS SSH Login Helper Argument Injection via Username "-2" (CVE-2026-86060 / MikroTrick) · unlock with TL Creds
• 🔒 MikroTik RouterOS '[indicator]' Persistence Script and '[indicator]' Scheduler Entry (MikroTrick) · unlock with TL Creds
• 🔒 MikroTik RouterOS Configuration Object Created With [indicator] (Post-Compromise Stored Data Manipulation) · unlock with TL Creds
• 🔒 SharePoint ToolPane Anonymous Code Injection Exploit Attempt (CVE-2026-65660) · unlock with TL Creds
• 🔒 SharePoint w3wp.exe Beaconing Outbound Over TLS — Possible Webshell C2 (CVE-2026-65660) · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 35 indicators of compromise for TL-2026-2669.

Sample indicators (3 of 35)

• IP address: 82.192.72[.]4
• File hash: d3faa4b443d98f272363f3484a5e6a9bab90979086aa2d31a1694c1dc8178742
• IP address: 103.102.31[.]18

Defanged, TLP:CLEAR. Full set of 35 indicators: unlock with TL Creds.

Technical analysis

FCEB agencies must remediate both by September 28, 2026.

On September 25, 2026, CISA added two unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming evidence of active exploitation for each.

CVE-2026-65660 is a code-injection vulnerability (CWE-94, CVSS 3.1 base score 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (SharePoint Server 2013 is also affected but is unsupported since April 2023 and will not receive a fix). The root cause is a parser desynchronization in SharePoint's SafeControls filter: when the ToolPane component reconstructs 'Register' directives from web-part markup, it writes attribute values inside double quotes without escaping embedded quotes, letting an attacker splice in additional directives after the SafeControls type check has already run. This lets a low-privileged authenticated attacker register arbitrary .NET classes, then trigger code execution via XamlServices.Parse() through an ObjectDataProvider deserialization gadget, producing an in-memory web shell that avoids on-disk artifacts and registry-permission failures that block cruder deserialization payloads. Microsoft originally classified the bug as a lower-severity spoofing issue (CVSS 6.5) before updating the advisory around September 11, 2026 to reflect its true remote-code-execution impact (CVSS 8.8). Threat-intelligence firm Previdian has observed live exploit attempts chaining CVE-2026-65660 with a separate, already-patched anonymous ToolPane access bug (documented by researcher @vcslab / Dinh Ho Anh Khoa of Viettel Cyber Security) to reach pre-authentication RCE on SharePoint farms that still permit anonymous access to ToolPane pages, delivering an encrypted loader that establishes an in-memory webshell communicating outbound over an encrypted channel to attacker C2 infrastructure. Patches have been available since Microsoft's August 11, 2026 security updates (fixed builds: SE 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001).

CVE-2026-67279 (CWE-841, Improper Enforcement of Behavioral Workflow, CVSS 3.1 6.5 / CVSS 4.0 6.9) is part of a six-CVE MikroTik RouterOS disclosure batch from CERT Polska (also including CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67281, and CVE-2026-86060). It occurs because RouterOS's SSH implementation advances into the connection protocol phase after a client-requested key re-exchange (rekey) even though the client never authenticated, letting an unauthenticated remote client open a session channel and send an exec request that the server dispatches — enabling unauthorized creation, overwrite, and reconstruction of files in RouterOS's managed file namespace, including configuration and diagnostic data. On its own this is a limited-impact bug, but CERT Polska and Bishop Fox (researcher Emilio Gallegos) documented that it is being chained in the wild — under the codename 'MikroTrick' — with CVE-2026-86060, an argument-injection flaw (CWE-88) in RouterOS's SSH login helper: the helper passes the client-supplied username as a command-line argument to a legacy helper program that treats arguments beginning with a dash as file-descriptor selectors, so a username of '-2' causes the helper to read its 'trusted identity' from file descriptor 2 — which is connected to the attacker's own terminal — and install full administrative permissions with no authentication at all. Bishop Fox fully reproduced the administrative-takeover chain on RouterOS 7.x builds (the rekey bypass alone also affects 6.x, but does not yield an administrative session there without the companion bug). CERT Polska traced attack logs to at least September 2, 2026 — one day before MikroTik shipped fixed builds (6.49.21 LTS, 7.23.4 LTS, 7.24.2 Stable) on September 3, 2026 — with confirmed successful compromises from IP 82.192.72.4 and additional exploitation attempts from 103.102.31.18. Compromised devices show a newly created privileged local account named 'ops', a persistence script named 'logrotate' that silently recreates any removed attacker accounts, and a Scheduler entry named 'daily-maint' that runs the script once per day; forensic RouterOS log lines show the signature 'login failure for user -2 from <ip> via ssh; user <name> added by ssh:-2@<ip>', and objects created through the chain carry owner="0" instead of a named administrator. Shadowserver identified more than 122,500 MikroTik devices with SSH reachable from the internet, concentrated in Brazil, the United States, Indonesia, Czechia, and Ukraine. CISA separately added the companion privilege-escalation bug, CVE-2026-86060, to the KEV catalog on September 11, 2026.

No threat-actor attribution has been published for either exploitation campaign; both appear to be opportunistic, internet-scale exploitation of internet-facing enterprise/network infrastructure rather than a targeted intrusion by a named group. FCEB agencies must remediate both catalog entries by September 28, 2026 per Binding Operational Directive 26-04.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1557 Adversary-in-the-Middle

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Name or Location; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Defense Evasion; T1562.001 Impair Defenses: Disable or Modify Tools; T1562.004 Impair Defenses: Disable or Modify System Firewall; T1620 Reflective Code Loading

Exfiltration

T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Persistence

T1053 Scheduled Task/Job; T1098 Account Manipulation; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter; T1059.008 Command and Scripting Interpreter: Network Device CLI

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1584.005 Compromise Infrastructure: Botnet

Remediation

Patches

• Microsoft August 2026 security update for SharePoint Server 2016 / 2019 / Subscription Edition
• MikroTik RouterOS 6.49.21 (LTS)
• MikroTik RouterOS 7.23.4 (LTS)
• MikroTik RouterOS 7.24.2 (Stable)

Immediate actions

• Apply Microsoft's August 2026 SharePoint security updates immediately if not already deployed (SE 16.0.19725.20522 / 2019 16.0.10417.20198 / 2016 16.0.5565.1001)
• Upgrade MikroTik RouterOS to 6.49.21 (LTS), 7.23.4 (LTS), or 7.24.2 (Stable) or later
• Restrict or disable SSH, HTTP/HTTPS, and bandwidth-test services on RouterOS devices until patched; permit only trusted management networks
• Disable anonymous access to ToolPane-reachable pages on internet-facing SharePoint farms as an interim mitigation
• Hunt internet-facing RouterOS devices for the 'ops' local account, the 'logrotate' script, and the 'daily-maint' Scheduler entry; check for owner="0" objects and the 'login failure for user -2 ... added by ssh:-2@<ip>' log signature

Workarounds

• SharePoint Server 2013 has no available patch (unsupported since April 2023) — isolate or decommission affected instances
• Restrict RouterOS SSH access via firewall rules to trusted management IPs only pending patch deployment
• Disable anonymous ToolPane access on SharePoint as an interim compensating control

Longer-term hardening

• Deploy detection for in-memory webshells and XAML/ObjectDataProvider deserialization gadgets on SharePoint farms (AMSI, memory-scanning EDR)
• Move network-device management interfaces (SSH, WebFig) off the public internet behind a VPN or bastion host
• Enable and monitor RouterOS's device-mode compromise flagging (/system/device-mode/print) on all managed routers
• Segment edge/perimeter network devices from internal management networks so a compromised router cannot pivot inward

Affected and fixed versions

• Microsoft — SharePoint Enterprise Server 2016
  Vulnerable versions: < 16.0.5565.1001
  Fixed in: 16.0.5565.1001
• Microsoft — SharePoint Server 2019
  Vulnerable versions: < 16.0.10417.20198
  Fixed in: 16.0.10417.20198
• Microsoft — SharePoint Server Subscription Edition
  Vulnerable versions: < 16.0.19725.20522
  Fixed in: 16.0.19725.20522
• Microsoft — SharePoint Server 2013
  Vulnerable versions: all versions (unsupported since April 2023, no fix planned)
• MikroTik — RouterOS
  Vulnerable versions: 6.0.0 - 6.49.20; 7.0.0 - 7.23.3; 7.24.0 - 7.24.1
  Fixed in: 6.49.21; 7.23.4; 7.24.2

Timeline

Last updated 2026-09-27 · 3 updates · revalidated 3× · latest source

• 2026-06-09 Microsoft ships a cumulative update closing the anonymous ToolPane/WebPartPage delivery weakness (no public CVE assigned) that later serves as the pre-authentication leg of the CVE-2026-65660 exploit chain.
• 2026-08-11 Microsoft ships the August 2026 security updates fixing CVE-2026-65660, initially classified as a lower-severity spoofing issue (CVSS 6.5).
• 2026-09-02 CERT Polska and Bishop Fox trace the earliest MikroTrick (CVE-2026-67279 + CVE-2026-86060) attack logs to this date, one day before MikroTik shipped fixes.
• 2026-09-03 MikroTik ships RouterOS 6.49.21 (LTS), 7.23.4 (LTS), and 7.24.2 (Stable), fixing the six-CVE disclosure batch including CVE-2026-67279 and CVE-2026-86060.
• 2026-09-04 Independent researchers publish patch-diff analysis identifying the specific SSH state-machine and login-helper changes underlying CVE-2026-67279 and CVE-2026-86060.
• 2026-09-05 CVE-2026-67279 and CVE-2026-86060 records are formally published (20:00:55 UTC); CERT Polska's advisory states evidence indicates attackers were exploiting the RouterOS bugs before public disclosure.
• 2026-09-05 CERT Polska publishes its initial advisory on active exploitation of the MikroTik RouterOS vulnerabilities, listing IOCs including the 'ops' account and attacker IPs.
• 2026-09-08 Bishop Fox and CERT Polska publish deep technical analyses of the MikroTrick chain, and Shadowserver reports over 122,500 internet-exposed RouterOS SSH endpoints.
• 2026-09-11 Microsoft updates the CVE-2026-65660 record to reflect remote code execution impact, raising the CVSS score to 8.8.
• 2026-09-11 CISA adds the companion privilege-escalation bug CVE-2026-86060 to the KEV catalog.
• 2026-09-24 Dinh Ho Anh Khoa (@vcslab / khoadha) of Viettel Cyber Security publishes full technical analysis of the SafeControls/ToolPane bypass, noting it can be chained with the anonymous-delivery bug for unauthenticated RCE and linking it to the ToolShell chain he demonstrated at Pwn2Own Berlin 2025, later exploited by Linen Typhoon, Violet Typhoon, and Storm-2603 against unrelated SharePoint CVEs.
• 2026-09-24 Previdian observes real-world two-stage exploitation of CVE-2026-65660 from IP locked-ioc-5 (~12:00 UTC), delivering an AES-encrypted second-stage .NET assembly and dropping the sphealth.aspx webshell.
• 2026-09-25 Microsoft confirms reliable evidence of active in-the-wild attacks against CVE-2026-65660, including webshell-creation attempts.
• 2026-09-25 Threat-intelligence firm Previdian reports observing SharePoint exploit attempts chaining CVE-2026-65660 with an anonymous ToolPane access bug to deliver encrypted in-memory webshells.
• 2026-09-25 CISA adds both CVE-2026-65660 and CVE-2026-67279 to the Known Exploited Vulnerabilities catalog, citing confirmed active exploitation evidence for each.
• 2026-09-26 The Hacker News publishes combined reporting on active exploitation of both the SharePoint code-injection flaw and the MikroTrick RouterOS takeover chain, consolidating public visibility into a single narrative.
• 2026-09-28 Deadline for FCEB agencies to remediate both CVE-2026-65660 and CVE-2026-67279 per Binding Operational Directive 26-04.

Update history

• 2026-09-27 — CISA Adds Actively Exploited Microsoft SharePoint (CVE-2026-65660) and MikroTik RouterOS (CVE-2026-67279) Flaws to KEV Catalog: What changed No escalation to severity/exploitability/status — both records already carry CRITICAL/ACTIVE for the SharePoint CVE.
• 2026-09-27 — Microsoft SharePoint RCE Flaw CVE-2026-65660 Exploited via SafeControls Bypass and In-Memory Webshell: What changed No escalation: CVSS (8.8), severity, exploitability (ACTIVE), and status (ACTIVE) all unchanged.
• 2026-09-27 — SharePoint Code Injection RCE (CVE-2026-65660) and MikroTik RouterOS "MikroTrick" Chain (CVE-2026-67279, CVE-2026-86060) Actively Exploited: What changed No field escalations — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (8.8), and attribution (LOW confidence, unattributed) are unchanged. The update is entirely additive forensic/technical depth.

Sources cited

• CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA · Advisory · 2026-09-25
• CISA Known Exploited Vulnerabilities Catalog (JSON feed) CISA · Government advisory · 2026-09-25
• NVD - CVE-2026-65660 Detail NVD (NIST) · Advisory · 2026-08-11
• NVD - CVE-2026-67279 Detail NVD (NIST) · Advisory · 2026-09-03
• Vulnerabilities in Mikrotik RouterOS software cert.pl · Research · 2026-09-03
• Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended cert.pl · Research · 2026-09-05
• MikroTrick: technical analysis, disclosure process, and the use of LLM agents cert.pl · Research · 2026-09-10
• MikroTrick: Inside the RouterOS Takeover Chain bishopfox.com · Research · 2026-09-08
• MikroTik September 2026 Vulnerability Advisory (MikroTrick) mikrotik.com · Vendor report · 2026-09-03
• Microsoft Security Response Center - CVE-2026-65660 Update Guide Microsoft Security Response Center · Vendor report · 2026-08-11
• SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild The Hacker News · News · 2026-09-26
• U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com · News · 2026-09-25
• SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE The Hacker News · News · 2026-09-11
• MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key The Hacker News · News · 2026-09-08
• MikroTik RouterOS vulnerabilities expose 122,500 routers cybernews.com · News · 2026-09-08

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Other reports on CVE-2026-65660

• CVE-2026-65660: Code Injection (ToolPane SafeControls Bypass) in Microsoft SharePoint Server Under Active Exploitation
• CISA Adds Actively Exploited WSO2 API Manager and Adobe Commerce Flaws to KEV Catalog, Warns on SharePoint Code Injection

Other reports on CVE-2026-67279

• Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)

Previous and next in vulnerability

• Multiple Vulnerabilities in Google Chrome Patched in Stable Channel Update 154.0.8037.57 (GovCERT.HK A26-09-37) Previous report