CISA Flags Actively Exploited SharePoint and MikroTik Flaws — Patch Now
Written by AI from the linked story. Not reviewed by an editor. How this works
CISA's addition of CVE-2026-65660 (Microsoft SharePoint) and CVE-2026-67279 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalog confirms that threat actors are actively leveraging these flaws in the wild. The root cause is a failure to apply timely patches to internet-facing systems, leaving critical infrastructure exposed to known, documented attack vectors. Federal agencies are legally bound under BOD 26-04 to remediate KEV-listed vulnerabilities on a mandated timeline, but the real risk extends to any organization running these products. Delayed patching of publicly exposed assets — especially network appliances and collaboration platforms — dramatically increases the attack surface and likelihood of compromise. This incident underscores that vulnerability management must be treated as a continuous, prioritized process rather than a periodic task.
Tactical Insight
Immediate actions
- Apply vendor-released patches for CVE-2026-65660 (SharePoint) and CVE-2026-67279 (MikroTik RouterOS) immediately across all affected systems.
- Run an authenticated vulnerability scan against all internet-facing assets to identify any additional unpatched exposures.
- Temporarily restrict or isolate affected SharePoint and MikroTik devices from public-facing networks until patches are confirmed applied.
Long-term improvements
- Establish a formal emergency patching SLA (e.g., 24–72 hours) for vulnerabilities appearing on the CISA KEV catalog.
- Maintain a continuously updated, authoritative inventory of all internet-exposed assets, including firmware versions on network appliances.
- Implement network segmentation to limit lateral movement potential from compromised SharePoint servers or edge routers.
Detection measures
- Configure SIEM alerting to trigger on exploitation indicators associated with new KEV catalog entries within 24 hours of publication.
- Enable detailed logging on SharePoint access events and MikroTik router traffic to detect anomalous activity indicative of exploitation.
- Subscribe to CISA KEV catalog feeds and vendor security advisories to ensure zero-delay notification of newly cataloged vulnerabilities.