CISA Reports Active Attacks Against Microsoft SharePoint and MikroTik RouterOS

The U.S. Cybersecurity and Infrastructure Security Agency has added two flaws affecting Microsoft SharePoint and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog, confirming that they are being actively exploited. These include CVE-2026-65660, a code injection vulnerability in Microsoft Office SharePoint with a CVSS score of 8.8. Its inclusion in the KEV catalog indicates that the attacks are no longer merely theoretical and that exposed organizations should consider applying available updates or mitigations an urgent priority. SharePoint is often integrated with identities, documents, and sensitive business processes, while MikroTik routers can provide attackers with a persistent foothold at the network perimeter. U.S. federal civilian agencies are required to remediate KEV vulnerabilities within the deadlines imposed by CISA, but private organizations should also use the catalog as a priority reference. Administrators should also look for indicators of compromise, because installing a patch after successful exploitation does not eliminate any persistent access that may have already been established.

Source: The Hacker News