Overview
Two vulnerabilities affecting Microsoft SharePoint Server and MikroTik RouterOS have been added to CISA’s Known Exploited Vulnerabilities catalogue following evidence of active exploitation. The SharePoint vulnerability, CVE-2026-65660, can allow an authorised attacker with limited privileges to execute code remotely. The MikroTik vulnerability, CVE-2026-67279, forms part of the MikroTrick attack chain that can provide unauthenticated attackers with full administrative control of vulnerable routers. Although the technologies are very different, both incidents expose the same architectural weakness: privileged functionality becoming reachable from a lower-trust security context.
SharePoint: From Limited Access to Code Execution
CVE-2026-65660 is a code-injection vulnerability affecting on-premises SharePoint Server environments. Originally classified more narrowly, Microsoft later confirmed that successful exploitation could result in remote code execution and reported evidence of active attacks. The vulnerability requires some level of authorised access, but that does not significantly reduce its importance. Once an attacker obtains compromised credentials or an initial foothold, a weakness that converts limited access into server-level execution can dramatically expand the impact of the intrusion.
MikroTrick: Crossing the Authentication Boundary
The MikroTik issue demonstrates an even more direct breakdown of trust. CVE-2026-67279 allows an SSH connection to progress into session functionality before user authentication has completed. When combined with CVE-2026-86060, attackers can manipulate the RouterOS login process and obtain full administrative privileges without a valid password or SSH key. The chain effectively crosses two security boundaries: first reaching functionality that should require authentication, then convincing a privileged component to trust attacker-controlled information. Internet-exposed routers have already been targeted using the technique.
Active Exploitation Changes the Priority
Once a vulnerability moves from theoretical risk to observed exploitation, vulnerability management becomes an incident-prevention exercise rather than a routine patching decision. Affected SharePoint Server installations should be brought to supported patched builds, while vulnerable RouterOS devices require the appropriate security updates and a review of unnecessary internet-facing administrative services. Systems exposed during the vulnerable period should also be reviewed for suspicious accounts, configuration changes, unusual authentication activity and other indicators of compromise. Patching prevents future exploitation. It does not prove that earlier exploitation never occurred.
Expert in the Cloud Insight
The common lesson across SharePoint and RouterOS is not simply that software vulnerabilities continue to appear. It is that security architecture depends on maintaining trust boundaries between users, services and privileged functions. In SharePoint, limited access could potentially become code execution. In RouterOS, an unauthenticated connection could ultimately become an administrative session. Once those boundaries collapse, controls further down the architecture may be operating on a false assumption of trust. Authentication and authorisation are not individual checkpoints. They form a chain—and a failure anywhere in that chain can redefine who the system believes should be trusted.
Leave a Reply