Affected Systems

CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.

Exploitation Status

Active exploitation confirmed by CISA and Microsoft. CVE-2026-67279 chained with CVE-2026-86060 (MikroTrick exploit) enables full unauthenticated administrative takeover of internet-exposed MikroTik routers. PoC publicly available and reproduced by Bishop Fox and CERT Polska.

Business Impact

SharePoint: Authenticated attackers can execute arbitrary code remotely (CVSS 8.8). MikroTik: Unauthenticated attackers gain full administrative control of exposed routers without credentials (CVSS 6.9 for CVE-2026-67279). FCEB agencies must patch by September 28, 2026. Scope and attribution of SharePoint attacks unknown; Microsoft confirmed observed exploitation as of September 25, 2026.

Urgency

đź”´ Immediate

Recommended Actions

  • Apply Microsoft security updates for CVE-2026-65660 immediately to all SharePoint Server instances; review Microsoft advisory for patch details.
  • Update MikroTik RouterOS 7.x devices to patched versions addressing CVE-2026-67279 and CVE-2026-86060; prioritize internet-exposed routers.
  • Audit SharePoint access logs for suspicious authenticated sessions and code execution attempts since mid-September 2026.
  • Review MikroTik router logs for unauthorized administrative sessions or exec requests from unauthenticated clients; check for policy mask anomalies in login process.
  • Restrict network exposure of SharePoint and MikroTik RouterOS management interfaces; enforce VPN or IP allowlisting where feasible.

---

# Geopolitical Context

Geopolitical Context

The addition of CVE-2026-65660 (SharePoint) and CVE-2026-67279 (MikroTik RouterOS) to CISA's Known Exploited Vulnerabilities catalog reflects ongoing threats to critical enterprise and network infrastructure. SharePoint's prevalence in government and corporate environments makes authenticated remote code execution particularly consequential for data integrity and operational continuity. The MikroTik vulnerability chain, enabling full unauthenticated administrative takeover of internet-exposed routers, poses risks to network perimeter security globally, particularly affecting small-to-medium enterprises and critical infrastructure operators relying on cost-effective routing solutions. Microsoft's acknowledgment of "reliable evidence of observed attacks" without attribution or scope disclosure suggests either ongoing investigation or sensitivity around targeting patterns. The simultaneous exploitation of enterprise collaboration platforms and edge network devices is consistent with multi-vector campaigns seeking both internal access and network persistence.

State Actor Alignment

No attribution or state-actor linkage has been disclosed by Microsoft, CISA, or CERT Polska. The targeting of widely deployed enterprise and network infrastructure is consistent with both state-sponsored espionage operations and financially motivated cybercrime. The lack of public attribution may indicate ongoing intelligence collection, private sector victim notification, or insufficient forensic indicators to support confident attribution. Federal agencies are mandated to remediate by September 28, 2026, under CISA's Binding Operational Directive 22-01, reflecting U.S. government prioritization of these vulnerabilities as threats to federal networks. The involvement of CERT Polska in analyzing the MikroTik exploit chain suggests potential European targeting or regional coordination on threat intelligence sharing.

Business Impacty pro region

The SharePoint vulnerability affects organizations globally that rely on Microsoft's collaboration ecosystem, with particular implications for government, defense, healthcare, and financial sectors where SharePoint is deeply embedded. The MikroTik RouterOS flaw disproportionately impacts regions with high adoption of MikroTik devices—including Eastern Europe, parts of Asia, and emerging markets—where cost-effective routing solutions are prevalent in both enterprise and critical infrastructure environments. Internet-exposed routers in these regions may serve as footholds for lateral movement into operational technology networks, telecommunications infrastructure, or government systems. The U.S. federal mandate for rapid remediation may create a security gap if international partners lack equivalent coordination mechanisms or patch deployment timelines, potentially enabling adversaries to shift focus to less-defended jurisdictions.

Forecast

If exploitation continues without widespread patching, adversaries are likely to leverage the SharePoint vulnerability for initial access to enterprise environments, enabling data exfiltration, credential harvesting, or ransomware deployment. The MikroTik exploit chain may be integrated into botnet recruitment campaigns or used to establish persistent network footholds for espionage operations. If state-sponsored actors are involved, targeting patterns may become clearer through victim telemetry or intelligence disclosures in coming weeks. Organizations that delay patching beyond CISA's September 28 deadline face elevated risk of compromise, particularly if proof-of-concept code becomes publicly available or exploit tooling is commoditized in underground markets. Continued silence on attribution may indicate either a lack of actionable intelligence or strategic decisions to avoid escalation with potential state sponsors.