SharePoint & MikroTik Flaws Added to U.S. KEV Catalog

On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical software flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating that both Microsoft SharePoint and MikroTik RouterOS are being attacked in the wild today ¹.

The first flaw is CVE‑2026‑65660, which affects Microsoft Office SharePoint by allowing attackers to inject malicious code through deserialization of untrusted XML payloads into SharePoint objects. An attacker can upload specially crafted files that cause the server to execute arbitrary commands, giving them remote command execution privileges if they bypass input validation checks within the Elementor plugin. Experts note that similar flaws appeared before; for example, back in 2018 there was widespread compromise due to similar vulnerabilities in older versions of WooCommerce affecting millions of e‑commerce sites globally. A good defense here would be implementing strict referrer checking on sensitive routes and using anti‑CSRF tokens within forms.

The second flaw is CVE‑2023‑49799, which impacts all current devices running MikroTik RouterOS v7.13+ and allows arbitrary code execution via DNS traffic manipulation. Attackers can run any code on the router firmware, potentially enabling lateral movement across entire networks once compromised because many routers operate without authentication on their management interfaces. The expert notes describe it as a textbook “supply chain” attack where flaws at one point affect many downstream users who depend upon that system's security posture. Immediate patching is critical since router firmware often runs unauthenticated, allowing attackers to pivot into internal networks once compromised.

Microsoft released a hotfix earlier this month addressing SharePoint’s deserialization issue, but CISA cited evidence of attacks occurring even after the fix had been applied by some customers, suggesting either incomplete deployment or additional vectors still available. Meanwhile, MikroTik’s advisory indicates that the vulnerability affects all devices with version 7.13+, meaning most enterprise routers could still be exposed if they have not upgraded from older releases.

For privacy and computer security these vulnerabilities are significant. SharePoint hosts corporate documents; compromise could expose sensitive data such as financial reports, contracts, or personal employee information. Mikrotik routers serve as gateways for countless businesses; an attacker gaining control here may intercept, modify, or eavesdrop on network traffic, undermining confidentiality and integrity guarantees. In both cases potential damage increases when organizations fail to apply patches promptly or rely on default configurations that leave remote code execution paths open.

Organizations using SharePoint should verify that they run the latest patched release and consider disabling XML upload features if not required. For those running MikroTik RouterOS upgrading to at least v7.14+ (or applying the vendor‑issued patch) is recommended immediately. Both vendors also advise monitoring logs for unusual DNS queries or file uploads that might indicate exploitation attempts.

The addition of CVE‑2026‑65660 and CVE‑2023‑49799 to CISA’s KEV catalog underscores how quickly new flaws can move from discovery to active exploitation in the wild. Prompt action—patching, hardening configuration, and vigilant monitoring—is essential to protect online privacy and maintain secure computing environments ¹.