Loading story…
CISA added CVE-2026-65660, a code-injection vulnerability in Microsoft SharePoint Server 2016, 2019, and Subscription Edition, to its Known Exploited Vulnerabilities catalog. The flaw allows an authenticated, low-privileged network user to execute arbitrary code remotely; CISA flags it for forensic triage following remediation.
CISA also listed CVE-2026-67279 in MikroTik RouterOS, which allows an unauthenticated client to open a session channel and issue an exec request. Active exploitation has been reported against internet-exposed devices, and attackers can chain it with CVE-2026-86060 to gain unauthenticated full administrative access. U.S. federal civilian agencies must remediate both vulnerabilities by September 28, 2026 under BOD 26-04 guidance.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CISA updated its Known Exploited Vulnerabilities catalog, adding Microsoft SharePoint code-injection flaw CVE-2026-65660 and MikroTik RouterOS authentication-workflow flaw CVE-2026-67279, increasing the catalog from 1,723 to 1,725 entries. The SharePoint flaw permits remote code execution by an authorized low-privileged user, while the RouterOS flaw can permit unauthenticated command execution and may be chained with CVE-2026-86060.
Successful attacks against internet-exposed MikroTik RouterOS devices using the MikroTrick exploit chain date to at least September 2, 2026. CERT Polska reported that chaining CVE-2026-67279 with CVE-2026-86060 could yield unauthenticated full administrative access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** added **CVE-2026-20963**, a **Microsoft SharePoint** deserialization flaw, to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation in the wild. The vulnerability allows an **unauthorized remote attacker** to execute arbitrary code over the network by sending crafted serialized data that SharePoint improperly deserializes, creating a **pre-authentication remote code execution** path. Reporting indicates the specific threat actors behind the attacks have not been publicly identified, but the flaw affects a widely deployed enterprise collaboration platform that often stores sensitive internal documents and communications. The KEV entry triggered urgent remediation requirements, including a **March 21, 2026** deadline for **FCEB agencies** under **Binding Operational Directive 22-01**. Additional reporting notes that the same KEV update also included vulnerabilities in **Wing FTP Server** and **Synacor Zimbra Collaboration Suite**, but the SharePoint issue stands out because of its likely value for **initial access brokers** and **ransomware affiliates** seeking enterprise footholds. Organizations using SharePoint should treat internet-exposed systems as high priority for patching and review for signs of compromise given confirmed in-the-wild exploitation.
Jun 29, 2026
CISA added **`CVE-2026-45659`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a high-severity remote code execution flaw in on-premises **Microsoft SharePoint Server**. The vulnerability stems from **deserialization of untrusted data** (`CWE-502`) and carries a **CVSS 8.8** score. It affects **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** below patched versions, and can be exploited over the network by an authenticated attacker with low privileges such as **Site Member**, without user interaction. Microsoft issued fixes in its **May 2026** security updates, later clarifying that the CVE had been inadvertently omitted from the initial update list. CISA set a **July 4, 2026** remediation deadline for federal civilian agencies under Binding Operational Directive 22-01, while public reporting said the exact vulnerable SharePoint component, gadget chain, payload delivery method, and any connection to ransomware activity had not yet been disclosed. Security guidance accompanying the KEV listing urged organizations to patch immediately and review exposed SharePoint environments for signs of compromise.
Jul 10, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1666 to 1670 entries and flagging active exploitation affecting **Microsoft Internet Key Exchange (IKE) Service Extensions**, **Microsoft SharePoint**, **Broadcom VMware vCenter**, and **Apple macOS Screen Sharing**. The newly listed issues are `CVE-2026-33824`, `CVE-2026-55040`, `CVE-2026-59310`, and `CVE-2026-65400`, covering weaknesses that can enable remote code execution, path traversal, weak authentication, or improper authentication. Under **BOD 22-01**, CISA directed U.S. federal agencies to remediate all four flaws by **2026-08-21** and urged other organizations to review exposure and apply available fixes. Reporting on the update said the SharePoint issue is tied to a JWT forgery attack chain, while the macOS Screen Sharing flaw was confirmed as actively exploited by the Dutch National Cyber Security Centre; Apple has already released patches, and CISA's KEV data indicates ransomware use is currently unknown for all four CVEs.
Aug 23, 2026