CISA added Microsoft SharePoint CVE-2026-65660 and MikroTik RouterOS CVE-2026-67279 to its Known Exploited Vulnerabilities catalog, confirming active exploitation and pulling both under the Sept. 28 federal remediation deadline. Microsoft also updated the SharePoint flaw from spoofing to remote code execution after seeing reliable evidence of attacks.
On RouterOS, the issue is not just an SSH bug: CERT Polska says it can be chained into MikroTrick, where an unauthenticated client reaches a session channel and then supplies policy state that makes the router behave like the attacker is an administrator. On SharePoint, the practical change is the same kind of escalation in a different layer: a flaw first framed as spoofing is now treated as a live code-execution path.
For teams running internet-exposed SharePoint or RouterOS, the important point is what survives the label change: the exposure is now a privileged control plane problem, not a narrow service defect. Any system hit before remediation may need to be treated as already exposed at the admin layer, and the reporting still leaves the attacker identity and full scope of exploitation unresolved.
CVSS 6.5 MEDIUM: improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized… Microsoft patch: 5002905.