Share Point RCE and Mikro Tik RouterOS Flaws Actively Exploited in the Wild
Summary: CISA added two flaws to its KEV catalog on Friday - CVE-2026-65660 in Microsoft SharePoint, which Microsoft reclassified from spoofing to remote code execution and said it had reliable evidence of observed attacks as of 9/25/2026, and CVE-2026-67279 in MikroTik RouterOS. The RouterOS flaw was chained with CVE-2026-86060, an argument injection flaw in the login process, in an exploit codenamed MikroTrick that CERT Polska said gave full unauthenticated administrative console access, and Bishop Fox reproduced a complete administrative takeover on vulnerable RouterOS 7.x builds.
Bottom line: MikroTrick needs no password to hand an attacker the router's administrative console, and FCEB agencies have until September 28, 2026 to apply fixes - the same deadline pressure now applies to any internet-exposed RouterOS 7.x device in your estate.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-65660CVE-2026-67279CVE-2026-86060
- Related
- Mikro Trick Chain Let Attackers Take Over Mikro Tik Routers Without a Password or SSH Key Cyber Risks ·CVE-2026-65660: Microsoft Share Point Code Injection Vulnerability Known Exploited Vulnerabilities · Sep 25, 2026