When the Label Enters the Triage Machine — SharePoint RCE and MikroTik's MikroTrick Land in KEV on the Same Day

On September 25, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation: CVE-2026-65660, a code-injection flaw in Microsoft SharePoint Server, and CVE-2026-67279, an improper-enforcement-of-behavioral-workflow flaw in MikroTik RouterOS (per CISA's alert). Fixes for both have shipped for weeks; the story is not that patches were missing, but that labels and triage priorities failed to catch up with what the flaws actually were.

On the Microsoft side, CVE-2026-65660 shipped in the August 11, 2026 patch cycle labeled as a 'spoofing' impact with a CVSS of 6.5 (moderate) and exploitation rated 'Less Likely.' The same MSRC entry also carries CWE-94 (improper control of generation of code, i.e., code injection), and the CVE record describes an authorized attacker as able to execute code over a network. MSRC's revision history shows the Impact and CVE title rewritten on August 27 (an 'informational change only,' per MSRC), and a September 25 revision stating that Microsoft 'had reliable evidence of observed attacks against exploitation of this vulnerability.' NVD reports a CVSS 3.1 base of 8.8 (high), revised on September 25, the same day as the KEV listing. MSRC's Security Update Guide continues to display the older 'spoofing' framing (per MSRC, NVD, and WindowsForum).

Confirmation of exploitation came quickly. As of September 22, 2026, reporting still held that no confirmed in-the-wild exploitation had been reported and the flaw was not in KEV. Two days later, on September 24, the Canadian Centre for Cyber Security (alert AL26-023) said it is aware of active exploitation of a Microsoft SharePoint Server vulnerability and warned that, chained with another SharePoint flaw, the result can be pre-authentication remote code execution on servers configured to permit anonymous access. The CVSS vector for the CVE itself requires low privileges; it needs a logged-in user on its own, but the chaining path may need no account at all. Threat-intelligence firm Previdian reportedly observed attacks chaining CVE-2026-65660 (authenticated) with a separate anonymous-delivery bug documented by @vcslab, delivering an encrypted loader to establish server control (via SecurityOnline and WindowsForum reporting). Per The Hacker News, the mechanism sits in SharePoint's SafeControls list (the filter that blocks dangerous server-side controls from loading): when the ToolPane component reconstructs Register directives from web-part markup, attribute values are written between double quotes without escaping quotes inside them, so an authenticated user can get classes past the filter and execute code on the SharePoint server.

Fixed builds: SharePoint Enterprise Server 2016 is affected before 16.0.5565.1001 (fixed in 16.0.5565.1001); SharePoint Server 2019 before 16.0.10417.20198 (fixed there); SharePoint Server Subscription Edition before 16.0.19725.20522 (fixed via KB5002893). 2016 and 2019 reached end of life on July 15, 2026. KB5002893 is the Subscription Edition package; farms running the current SharePoint Workflow Manager must install KB5002799 first, and the ToolPane feature is disabled by default starting with the September 2026 public update (re-enableable per site collection). Researcher Dinh Ho Anh Khoa reports the flaw also affects SharePoint 2013, which Microsoft's advisory does not list and which has had no updates since April 2023; isolation or migration is the only path there. None of the sources reviewed indicates SharePoint Online is affected; the advisories address on-premises servers only. CISA listed CVE-2026-65660 in KEV on September 25 with a federal remediation deadline of September 28 under BOD 26-04, and forensic triage is marked Yes — the requirement to check whether compromise preceded the patch. MSRC's advisory still displays 'exploited: No,' so dashboards that pull exploited status from Microsoft's feed may show a stale value (per WindowsForum).

The MikroTik RouterOS side, CVE-2026-67279, is an improper enforcement of behavioral workflow (CWE-841) in the SSH connection path, affecting 7.24 up to (excluding) 7.24.2, 7.0.0 up to 7.23.4, and 6.0.0 up to 6.49.21. CERT Polska coordinated disclosure of six RouterOS vulnerabilities in September. The three most important: CVE-2026-67276 (SSH authentication bypass, CVSS 9.2 — RouterOS did not compare the complete RSA public key, checking key type and modulus but omitting the exponent; an attacker who knows an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel without the private key), CVE-2026-86060 (privilege escalation via crafted usernames beginning with a disallowed character, CVSS 9.2), and CVE-2026-67277 (memory disclosure and DoS via the bandwidth-test service, CVSS 8.8). The two-CVE combination is named 'MikroTrick' and can take full control of any device whose SSH service is reachable from a public network. CVE-2026-67279 alone: after a client-requested SSH rekey, an affected build can proceed into the connection protocol even though user authentication was never attempted, letting an unauthenticated client open a session channel and send an exec request that the server dispatches — unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files holding configuration and diagnostic data. CERT Polska confirmed attacks have been occurring since at least September 2, attributed to IP 82.192.72.4 (with attempts from 103.102.31.18), leaving log markers such as 'login failure for user -2' and 'user <name> added by ssh:-2@<ip>', plus a highly privileged user named 'ops'. The fixed releases (6.49.21 / 7.23.4 / 7.24.2 / 7.25beta3) ship a startup configuration scan with a 'Flagged' marker; CERT Polska stresses the marker detects only selected traces, so its absence is not proof of safety, and unknown vulnerabilities cannot be ruled out. MikroTik's September 3 security bulletin says most configurations are not at risk but recommends upgrading; the default configuration blocks SSH from the internet, so exposure centers on administrators who opened it manually. CISA listed only CVE-2026-67279 of the six in KEV, with a September 28 due date (per CERT Polska, MikroTik, CISA, NVD, and Greenbone).

Analysis (separated from facts): what deserves attention is less 'which CVE is severe' than what happens when a label becomes part of the triage machine. The SharePoint sequence is the chain: the vendor's advisory label feeds the triage queue, the queue sets patch priority, and priority decides whether the flaw is fixed before it is exploited. A flaw labeled 'spoofing, moderate, less likely to be exploited' that actually carried code execution meant every downstream decision consumed a wrong input. This is isomorphic to the structures this observatory has covered recently — Bitget's approval flow, where spoofed transaction data contaminated the information feeding the approval decision, and F5 BIG-IP APM's OAuth zero-day, where the identity-issuing side itself was unauthenticated-RCE'd. In each case what broke was the issuing side (here: the vendor's own severity label), and the decision plane (the patch queue) consumed it as primary information. CWE-94 and the CVSS vector were present in the MSRC entry, and the revision history (the August 27 Impact change) was public, but the field that got read was the Impact label. A label and a vector are the API of risk information; when a field drifts from its intended meaning, only the side that cross-checks the fields against each other triages correctly.

Defensive implications: (1) BOD 26-04's forensic-triage requirement asks for confirmation that no compromise preceded the patch — patching alone does not satisfy it. For SharePoint: verify each on-premises farm reached the fixed build (16.0.5565.1001 / 16.0.10417.20198 / 16.0.19725.20522), then review SharePoint, IIS, endpoint, and authentication logs for the indicators the Canadian Centre flags (unexpected web-part changes, suspicious access to IIS machine keys, web shells, deserialization activity, and AMSI/Defender detections tied to SharePoint); on Subscription Edition, enable AMSI in Full Mode. (2) For RouterOS: update to 7.24.2 / 7.23.4 / 6.49.21 or later, restrict SSH to trusted IPs or a VPN, and treat the 'Flagged' marker as a lower bound on compromise — inspect unknown users, scripts, scheduler tasks, and tunnels regardless. (3) As process: treat the vendor label as one input to risk-based prioritization, not the input — cross-check CWE, the CVSS vector, KEV status, and EPSS, and put label revisions (such as the August 27 Impact change) and post-patch exploitation signals (KEV listing, CERT warnings) into the pipeline as first-class events. Facts here draw on CISA's alert (https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog), MSRC's CVE-2026-65660 entry (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660), NVD's CVE-2026-67279 (https://nvd.nist.gov/vuln/detail/CVE-2026-67279), the Canadian Centre for Cyber Security alert AL26-023 (https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660), CERT Polska's RouterOS warning (https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ and its CVE list https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve), MikroTik's September 2026 security bulletin (https://mikrotik.com/supportsec/september-2026-vulnerability/), The Hacker News (https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html and https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html), WindowsForum (https://windowsforum.com/news/cve-2026-65660-cisa-flags-exploited-sharepoint-code-injection.446015/), and Greenbone (https://www.greenbone.net/en/blog/mikrotik-routeros-ssh-vulnerability/). Analysis is kept separate from reporting.