CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA's addition of CVE-2026-65660 (Microsoft SharePoint) and CVE-2026-67279 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalog confirms that threat actors are actively leveraging these flaws in the wild. The root cause is a failure to apply timely patches to internet-facing systems, leaving critical infrastructure exposed to known, documented attack vectors. Federal agencies are legally bound under BOD 26-04 to remediate KEV-listed vulnerabilities on a mandated timeline, but the real risk extends to any organization running these products. Delayed patching of publicly exposed assets — especially network appliances and collaboration platforms — dramatically increases the attack surface and likelihood of compromise. This incident underscores that vulnerability management must be treated as a continuous, prioritized process rather than a periodic task.