CISA adds Microsoft SharePoint CVE-2026-65660 and MikroTik RouterOS CVE-2026-67279 to KEV catalog over active exploitation

Linha do tempo

1. cisa.gov ↗ · pub. 25/09/2026 09:00 · coletado 19/10 18:37 primeiro registro

   CISA adds Microsoft SharePoint CVE-2026-65660 and MikroTik RouterOS CVE-2026-67279 to KEV catalog over active exploitation

   ler a análise desta fonte ocultar

   CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-65660, a code injection flaw in Microsoft SharePoint, and CVE-2026-67279, an improper enforcement of behavioral workflow flaw in MikroTik RouterOS. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical exploitation details, threat actor attribution, victim information or IOCs. It restates the requirements of BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, and CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

   Technical Details

   • CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability.
   • CVE-2026-67279: MikroTik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability.
   • The article does not list affected versions, exploitation methods or whether the flaws are chained.

   Remediation

   • Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
   • BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
   • CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
   • The article gives no specific patch or mitigation guidance; consult the vendor advisories from Microsoft and MikroTik.