SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

CISA has placed two actively exploited vulnerabilities into its Known Exploited Vulnerabilities catalog: CVE-2026-65660, a code-injection flaw in Microsoft SharePoint rated 8.8 on CVSS, and CVE-2026-67279, a workflow-enforcement bug in Mikrotik RouterOS rated 6.9. Microsoft originally classified the SharePoint issue as a spoofing bug but has now confirmed it can be weaponized for remote code execution, and says it has credible evidence of real-world attacks, though details on the attackers and victims remain undisclosed. The RouterOS flaw is being used alongside a separate argument-injection bug, CVE-2026-86060, in an attack chain dubbed MikroTrick that grants unauthenticated, full administrative access to exposed routers by combining a session-channel bypass with a spoofed login identity. Researchers from CERT Polska and Bishop Fox independently verified the takeover on vulnerable 7.x builds, and federal agencies have been given until September 28, 2026, to remediate both issues.