# CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth Bypass (CVE-2026-67279)

> CISA added CVE-2026-65660 (Microsoft SharePoint Server code injection, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS SSH authentication-bypass, part of the 'MikroTrick' chain) to its Known Exploited Vulnerabilities catalog on September 25, 2026, citing confirmed active exploitation. SharePoint attacks chain the flaw with an anonymous ToolPane access bug to deliver encrypted in-memory webshells, while RouterOS attacks combine it with CVE-2026-86060 to seize full unauthenticated administrative control of internet-exposed routers. FCEB agencies must remediate both by September 28, 2026.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-27T14:35:43.799Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2669
- **ID:** TL-2026-2669
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65660, CVE-2026-67279, CVE-2026-86060, CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67281

## Description

On September 25, 2026, CISA added two unrelated but simultaneously disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming evidence of active exploitation for each.

CVE-2026-65660 is a code-injection vulnerability (CWE-94, CVSS 3.1 base score 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (SharePoint Server 2013 is also affected but is unsupported since April 2023 and will not receive a fix). The root cause is a parser desynchronization in SharePoint's SafeControls filter: when the ToolPane component reconstructs 'Register' directives from web-part markup, it writes attribute values inside double quotes without escaping embedded quotes, letting an attacker splice in additional directives after the SafeControls type check has already run. This lets a low-privileged authenticated attacker register arbitrary .NET classes, then trigger code execution via XamlServices.Parse() through an ObjectDataProvider deserialization gadget, producing an in-memory web shell that avoids on-disk artifacts and registry-permission failures that block cruder deserialization payloads. Microsoft originally classified the bug as a lower-severity spoofing issue (CVSS 6.5) before updating the advisory around September 11, 2026 to reflect its true remote-code-execution impact (CVSS 8.8). Threat-intelligence firm Previdian has observed live exploit attempts chaining CVE-2026-65660 with a separate, already-patched anonymous ToolPane access bug (documented by researcher @vcslab / Dinh Ho Anh Khoa of Viettel Cyber Security) to reach pre-authentication RCE on SharePoint farms that still permit anonymous access to ToolPane pages, delivering an encrypted loader that establishes an in-memory webshell communicating outbound over an encrypted channel to attacker C2 infrastructure. Patches have been available since Microsoft's August 11, 2026 security updates (fixed builds: SE 16.0.19725.20522, 2019 16.0.10417.20198, 2016 16.0.5565.1001).

CVE-2026-67279 (CWE-841, Improper Enforcement of Behavioral Workflow, CVSS 3.1 6.5 / CVSS 4.0 6.9) is part of a six-CVE MikroTik RouterOS disclosure batch from CERT Polska (also including CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67281, and CVE-2026-86060). It occurs because RouterOS's SSH implementation advances into the connection protocol phase after a client-requested key re-exchange (rekey) even though the client never authenticated, letting an unauthenticated remote client open a session channel and send an exec request that the server dispatches — enabling unauthorized creation, overwrite, and reconstruction of files in RouterOS's managed file namespace, including configuration and diagnostic data. On its own this is a limited-impact bug, but CERT Polska and Bishop Fox (researcher Emilio Gallegos) documented that it is being chained in the wild — under the codename 'MikroTrick' — with CVE-2026-86060, an argument-injection flaw (CWE-88) in RouterOS's SSH login helper: the helper passes the client-supplied username as a command-line argument to a legacy helper program that treats arguments beginning with a dash as file-descriptor selectors, so a username of '-2' causes the helper to read its 'trusted identity' from file descriptor 2 — which is connected to the attacker's own terminal — and install full administrative permissions with no authentication at all. Bishop Fox fully reproduced the administrative-takeover chain on RouterOS 7.x builds (the rekey bypass alone also affects 6.x, but does not yield an administrative session there without the companion bug). CERT Polska traced attack logs to at least September 2, 2026 — one day before MikroTik shipped fixed builds (6.49.21 LTS, 7.23.4 LTS, 7.24.2 Stable) on September 3, 2026 — with confirmed successful compromises from IP 82.192.72.4 and additional exploitation attempts from 103.102.31.18. Compromised devices show a newly created privileged local account named 'ops', a persistence script named 'logrotate' that silently recreates any removed attacker accounts, and a Scheduler entry named 'daily-maint' that runs the script once per day; forensic RouterOS log lines show the signature 'login failure for user -2 from <ip> via ssh; user <name> added by ssh:-2@<ip>', and objects created through the chain carry owner="0" instead of a named administrator. Shadowserver identified more than 122,500 MikroTik devices with SSH reachable from the internet, concentrated in Brazil, the United States, Indonesia, Czechia, and Ukraine. CISA separately added the companion privilege-escalation bug, CVE-2026-86060, to the KEV catalog on September 11, 2026.

No threat-actor attribution has been published for either exploitation campaign; both appear to be opportunistic, internet-scale exploitation of internet-facing enterprise/network infrastructure rather than a targeted intrusion by a named group. FCEB agencies must remediate both catalog entries by September 28, 2026 per Binding Operational Directive 26-04.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.008 Command and Scripting Interpreter: Network Device CLI
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1573 Encrypted Channel
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1068 Exploitation for Privilege Escalation
- T1562.001 Impair Defenses: Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1005 Data from Local System
- T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
- T1071.001 Application Layer Protocol: Web Protocols
- T1211 Exploitation for Defense Evasion
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1562.004 Impair Defenses: Disable or Modify System Firewall
- T1557 Adversary-in-the-Middle
- T1090 Proxy
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1584.005 Compromise Infrastructure: Botnet

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD - CVE-2026-65660 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-65660)
- [NVD - CVE-2026-67279 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67279)
- [SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild](https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html)
- [U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/199777/hacking/u-s-cisa-adds-microsoft-sharepoint-and-mikrotik-routeros-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE](https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html)
- [MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key](https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html)
- [Vulnerabilities in Mikrotik RouterOS software](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/)
- [Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)
- [MikroTrick: technical analysis, disclosure process, and the use of LLM agents](https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/)
- [MikroTrick: Inside the RouterOS Takeover Chain](https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain)
- [MikroTik RouterOS vulnerabilities expose 122,500 routers](https://cybernews.com/security/mikrotik-routers-under-active-exploitation/)
- [MikroTik September 2026 Vulnerability Advisory (MikroTrick)](https://mikrotik.com/supportsec/september-2026-vulnerability/)
- [Microsoft Security Response Center - CVE-2026-65660 Update Guide](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2669