Microsoft SharePoint and MikroTik RouterOS — RCE and Privilege Escalation Flaws Actively Exploited in the Wild (CVE-2026-65660)

Publication date: September 26, 2026
Category: Vulnerability / Network Security

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical security flaws impacting Microsoft SharePoint and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing verified evidence of active exploitation in the wild. This discovery highlights complex exploitation chains targeting network routing equipment alongside remote code execution vulnerabilities in enterprise collaboration servers, initially mischaracterized before coordinated malicious activity surfaced across telemetry sensors.

What is the KEV Catalog and the Affected Components? (General Analysis)

CISA’s KEV catalog tracks security flaws carrying confirmed exploitation evidence, mandating federal action and strongly urging private sector organizations to apply rapid remediation.

The incident involves two distinct technological domains:

  • Microsoft Office SharePoint: Enterprise collaboration platform widely deployed for document management and internal web portals. The flaw CVE-2026-65660 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — Score: 8.8, High) represents a code injection issue (Improper control of generation of code, CWE-94), which was initially mislabeled by the vendor as a spoofing vulnerability.
  • MikroTik RouterOS: Proprietary Linux-based operating system powering MikroTik routers and switches, extensively deployed across perimeter and service provider networks. The associated vulnerabilities are CVE-2026-67279 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N — Score: 6.9, Medium; CWE-841) and CVE-2026-86060 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — Score: 9.2, Critical; CWE-88).

How Does It Work? (Technical Analysis)

Forensic and telemetry data break down two distinct and highly dangerous attack vectors:

  • SharePoint Exploitation Flow (CVE-2026-65660):

    • Exploit Entry: An authenticated attacker possessing minimal network privileges interacts with vulnerable SharePoint endpoints via crafted web requests.
    • Injection and Execution: Due to improper control over code generation, supplied input is dynamically interpreted, enabling the attacker to execute arbitrary code with the web service privileges across the network, facilitating two-stage exploitation attempts observed by commercial sensors.

  • MikroTik RouterOS Chain (“MikroTrick”, CVE-2026-67279 and CVE-2026-86060):

    • Trust Boundary Breakdown: The MikroTrick chain merges flaws across different layers of the RouterOS SSH protocol. CVE-2026-67279 allows an unauthenticated client to open a session channel following a client-requested rekey, even though user authentication was never attempted.
    • Argument Manipulation and Escalation: Through CVE-2026-86060, an argument-handling flaw in the SSH login path involving usernames starting with a prohibited character allows the trusted RouterOS policy mask to be modified.
    • Full Takeover: Combining both vulnerabilities leads to unauthenticated creation, overwrite, and reconstruction of files within the RouterOS managed file namespace, granting complete unauthenticated administrative access to the console without requiring a password.

“MikroTrick combines two failures at different trust boundaries: the first allows an unauthenticated connection to reach functionality that RouterOS should expose only after login. The second causes the login process to treat data from that connection as a trusted administrative identity.” — Emilio Gallegos (Bishop Fox)

Affected Systems / Environments

Exposed environments span enterprise servers running vulnerable builds of Microsoft Office SharePoint and edge networking devices operating specific MikroTik RouterOS versions.

CVE Category (CWE) Impact CVSS Vector (Summary)
CVE-2026-65660 CWE-94 (Code Injection) RCE / High 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-67279 CWE-841 (Improper Enforcement of Behavioral Workflow) Unauthenticated Session Creation / Medium 6.9 (Medium) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N
CVE-2026-86060 CWE-88 (Improper Neutralization of Argument Delimiters) Privilege Escalation / Critical 9.2 (Critical) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H

Note on patched RouterOS versions: The RouterOS vulnerabilities were remediated in versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

Mitigation and Detection

Remediation

  1. Immediate Patching: Apply the latest security updates and bulletins provided by Microsoft for SharePoint environments.
  2. RouterOS Firmware Upgrade: Immediately upgrade vulnerable MikroTik routers to the fixed Long-term or Stable releases (6.49.21, 7.23.4, 7.24.2, or later).
  3. Service Exposure Restriction: Disable SSH access from public internet interfaces on networking gear; restrict administrative management to trusted internal subnets or dedicated VPN tunnels.

Detection

  • SSH Authentication Log Monitoring: Inspect for anomalous connection attempts utilizing usernames with unusual prefixes or rekey sequences lacking prior successful authentication.
  • Perimeter Telemetry Analysis: Audit unusual HTTP requests targeting SharePoint components involving dynamic code execution indicators.
regex 
# Conceptual detection rule for anomalous RouterOS SSH login attempts
^\S+\sssh-login\[\d+\]:\s+unauthenticated\s+session\s+opened\s+with\s+prohibited\s+prefix

Wrapping Up

The inclusion of CVE-2026-65660, CVE-2026-67279, and CVE-2026-86060 in the KEV catalog highlights how aggressively threat actors weaponize trust boundary and code execution flaws. The MikroTrick chain illustrates how seemingly disparate vulnerabilities in network protocols can merge to compromise critical infrastructure completely unassisted. Rapid defensive response through patching and perimeter segmentation remains vital for mitigating operational risk.

References