Vulnerabilities
CISA Adds SharePoint and Mikrotik RouterOS Vulnerabilities to KEV Catalog
CISA has listed two newly exploited CVEs—Microsoft SharePoint code injection (CVE‑2026‑65660) and Mikrotik RouterOS workflow enforcement flaw (CVE‑2026‑67279)—in its Known Exploited Vulnerabilities catalog. Federal agencies and all organizations should prioritize patching these high‑risk flaws and verify that exposed assets are not already compromised.
What happened
CISA added two CVEs to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild.
Impact
- CVE‑2026‑65660 – Microsoft SharePoint code injection that can allow attackers to execute arbitrary code on the SharePoint server.
- CVE‑2026‑67279 – Mikrotik RouterOS flaw that bypasses behavioral workflow enforcement, giving attackers full control over the device.
What to do
- Verify whether your environment runs Microsoft SharePoint or Mikrotik RouterOS and check the version against the CVE references.
- Apply the vendor‑issued patches immediately; Microsoft and Mikrotik have released mitigations.
- Scan publicly exposed assets for signs of exploitation and isolate compromised systems.
- Update your vulnerability management process to treat KEV catalog items as high‑risk and remediate them before other lower‑risk issues.
Additional guidance
Federal agencies must follow BOD 26‑04, prioritizing rapid remediation of KEV items that grant total control of an asset. All organizations are encouraged to adopt the same risk‑based approach.
Related vulnerabilities
CISA Expands KEV Catalog with Two New MikroTik RouterOS Exploits
CISA has added two actively exploited vulnerabilities that target MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog. CVE‑2026‑67277 allows attackers to bypass authentication for a critical function, while CVE‑2026‑86060 lets them inject malicious commands by exploiting improper argument neutralization. The update reinforces federal guidance under BOD 26‑04 to prioritize rapid patching of high‑risk flaws on publicly exposed assets, and invites all organizations to adopt a risk‑based approach to remediation.
Read briefing
CISA Expands KEV Catalog with Two New MikroTik RouterOS Vulnerabilities
CISA has added CVE‑2026‑67277 and CVE‑2026‑86060 to its Known Exploited Vulnerabilities catalog after confirming active attacks. The flaws let attackers bypass authentication and inject malicious commands on MikroTik RouterOS devices, giving full control. Federal agencies are urged to patch immediately under BOD 26‑04, which prioritizes remediation of high‑risk KEVs on publicly exposed assets. All organizations are encouraged to adopt a risk‑based approach and can submit new KEVs for consideration via CISA’s nomination form.
Read briefing
CISA Adds Four Exploited Vulnerabilities to KEV Catalog
CISA has added four CVEs—CVE‑2026‑0322, CVE‑2026‑76519, CVE‑2026‑105133, CVE‑2026‑105134—to its Known Exploited Vulnerabilities catalog. The vulnerabilities affect Palo Alto Networks PAN‑OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS, and grant attackers full control of exposed assets. Defenders should prioritize patching and verify no compromise before applying updates.
Read briefing
CISA Adds Two Linux Kernel Vulnerabilities to KEV Catalog
CISA has added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to its Known Exploited Vulnerabilities catalog. The additions underscore the need for rapid patching of publicly exposed assets that could grant full control. Defenders should verify patch status and monitor for exploitation indicators.
Read briefing