By Pierluigi Paganini
September 25, 2026
The United States Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority directive, mandating that all Federal Civilian Executive Branch (FCEB) agencies take immediate action to secure their infrastructure against two newly identified, actively exploited vulnerabilities. The agency has officially added CVE-2026-65660, affecting Microsoft SharePoint Server, and CVE-2026-67279, impacting MikroTik RouterOS, to its prestigious Known Exploited Vulnerabilities (KEV) catalog.
This move underscores the escalating threat landscape facing both public and private sector organizations. With these additions, CISA has set a stringent remediation deadline of September 28, 2026, signaling the severity of the threat posed by these flaws.
Main Facts: The Vulnerabilities at a Glance
The two vulnerabilities added to the KEV catalog represent distinct yet equally dangerous threats to network security.
CVE-2026-65660: Microsoft SharePoint Code Injection
CVE-2026-65660 is a critical code-injection vulnerability residing within Microsoft SharePoint Server. This flaw allows an authenticated, low-privileged attacker to achieve remote code execution (RCE). By leveraging this vulnerability, an attacker can bypass standard security controls to execute arbitrary commands, effectively gaining a foothold within the server environment. The vulnerability affects a wide range of deployments, specifically:
- SharePoint Server 2016
- SharePoint Server 2019
- SharePoint Subscription Edition
CVE-2026-67279: The MikroTik RouterOS SSH Bypass
The second vulnerability, tracked as CVE-2026-67279, carries a CVSS score of 6.9 and is considered particularly volatile due to its nature as an authentication bypass. This SSH protocol flaw allows an unauthenticated, remote attacker to circumvent the standard authentication process. By opening a session channel, the attacker can execute commands, modify system files, or disrupt device operations.
Perhaps most concerning is that this flaw is not acting in isolation. When chained with another recently discovered flaw—CVE-2026-86060—the attack sequence results in full administrative access to the compromised device without any requirement for valid credentials.
Chronology of the "MikroTrick" Campaign
The discovery of the exploitation of MikroTik devices has been a subject of intense focus for security researchers and intelligence agencies alike.
- September 2, 2026: The earliest confirmed evidence of these attacks appeared, with threat actors targeting internet-exposed RouterOS devices.
- Mid-September 2026: Researchers at CERT Polska began documenting an advanced attack chain, which they dubbed the "MikroTrick" chain. This chain was observed leveraging artificial intelligence tools to optimize the exploit delivery and bypass detection mechanisms.
- September 20, 2026: Security researchers published detailed reports confirming that the exploitation of CVE-2026-67279 was occurring in the wild, specifically targeting the SSH protocol implementation in MikroTik firmware.
- September 25, 2026: CISA formally acknowledged the threat by placing the vulnerability into the KEV catalog, officially triggering Binding Operational Directive (BOD) 22-01.
The rapid escalation from initial identification to widespread exploitation highlights the sophistication of current threat actors, who are increasingly capable of chaining vulnerabilities to maximize their impact.
Supporting Data and Technical Implications
To understand the urgency of CISA’s mandate, one must look at the technical implications for the affected infrastructure.
The SharePoint Risk Vector
SharePoint serves as the backbone for document management and collaborative workflows for countless government agencies and corporations. A code-injection vulnerability at this level is a "crown jewel" target for adversaries. Because the exploit allows for RCE, an attacker could potentially move laterally through a network, exfiltrate sensitive government data, or install persistent backdoors. The requirement for a "low-privileged" account means that any compromised user account—whether through phishing or credential stuffing—could serve as a launching pad for a full-scale network breach.
The MikroTik Exploitation Chain
The "MikroTrick" chain represents a maturation in how threat actors handle embedded device security. MikroTik routers are ubiquitous in both SOHO (Small Office/Home Office) and enterprise environments. By chaining CVE-2026-67279 with CVE-2026-86060, attackers are effectively rendering traditional password-based security measures obsolete.
CERT Polska’s analysis suggests that the attackers are using these exploits to gain persistent, administrative-level control over routers. Once control is established, these devices are often used as nodes in larger botnets, for traffic interception, or as entry points into the broader internal networks they are meant to protect.
Official Responses and Regulatory Mandates
The inclusion of these vulnerabilities in the KEV catalog is not merely a recommendation; it is a regulatory requirement under Binding Operational Directive (BOD) 22-01.
The Role of BOD 22-01
BOD 22-01 was established to reduce the significant risk posed by known exploited vulnerabilities. Under this directive, FCEB agencies are legally required to:
- Assess: Identify all assets within their jurisdiction that contain the listed vulnerabilities.
- Remediate: Apply patches or implement mitigating controls by the deadline specified by CISA (in this case, September 28, 2026).
- Report: Ensure compliance through the CISA reporting portal.
CISA officials have emphasized that the three-day window for remediation is indicative of the "imminent and high-impact" nature of these vulnerabilities. While the directive strictly applies to federal agencies, CISA strongly encourages private organizations to follow the same protocol. "The KEV catalog is a living record of the most dangerous threats currently being leveraged by malicious actors," a CISA representative noted. "Ignoring these entries is equivalent to leaving the front door of your network wide open."
Broader Implications for Global Cybersecurity
The events of late September 2026 serve as a stark reminder of the fragile state of enterprise and government cybersecurity.
The Challenge of Patch Management
The inclusion of a Microsoft SharePoint vulnerability highlights the recurring difficulty of managing complex, enterprise-level software. Despite the frequency of Microsoft’s "Patch Tuesday" updates, the discovery of RCE flaws in mature products like SharePoint demonstrates that legacy codebases remain a high-risk area. Organizations must move toward a more agile patching lifecycle to survive in the current threat environment.
The Rise of AI-Assisted Attacks
The mention of the "MikroTrick" chain being analyzed and facilitated by AI is a disturbing trend. Threat actors are increasingly using machine learning models to identify zero-day vulnerabilities, map out target network topographies, and automate the chaining of multiple exploits. This creates an asymmetric conflict where defenders must constantly play catch-up against automated, highly efficient offensive capabilities.
Infrastructure Resilience
MikroTik devices, while highly effective and cost-efficient, are often "set-and-forget" pieces of hardware. This philosophy is dangerous in an era where network perimeter devices are the primary target for state-sponsored actors and cybercriminal syndicates. The vulnerability highlights the urgent need for:
- Regular Firmware Audits: Moving beyond automatic updates to active, manual verification of security patches.
- Network Segmentation: Ensuring that if a router is compromised, the attacker cannot easily pivot to sensitive internal servers.
- Zero-Trust Architectures: Transitioning away from the assumption that the network perimeter is secure.
Conclusion
The addition of CVE-2026-65660 and CVE-2026-67279 to the CISA KEV catalog is a significant development that should prompt immediate action across the cybersecurity community. Whether you are an IT administrator for a federal agency or a security lead in the private sector, the directive is clear: the window of opportunity for attackers to exploit these flaws is open, and the risk of inaction is catastrophic.
By September 28, 2026, the mandate for federal agencies will be in full effect, but the private sector would be wise to adopt the same timeline. The "MikroTrick" campaign and the SharePoint injection vulnerability are stark indicators that threat actors are moving faster than ever. Robust, proactive, and rapid patch management is no longer an optional best practice; it is the fundamental requirement for survival in the digital age.
Follow SecurityAffairs on Twitter, Facebook, and Mastodon for the latest updates on this developing situation.
