SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
Positions CISA’s KEV listing as a protective, reactive safeguard rather than highlighting vendor responsibility for shipping vulnerable code or delayed disclosure timelines.
View original on thehackernews.comOverview
CISA added two actively exploited vulnerabilities—one in Microsoft SharePoint and one in MikroTik RouterOS—to its Known Exploited Vulnerabilities (KEV) catalog, signaling confirmed real-world exploitation and mandating urgent patching for federal agencies.
TL;DR
- CISA listed CVE-2026-65660 (SharePoint code injection, CVSS 8.8) and a MikroTik RouterOS flaw in its KEV catalog.
- Inclusion means CISA has evidence of active exploitation in the wild.
- Federal agencies must remediate these flaws within prescribed timeframes per Binding Operational Directive 22-01.
Key Stats
8.8
CVSS severity score
High-severity code injection vulnerability in SharePoint
2
vulnerabilities added
Both confirmed as actively exploited
Questions Answered
Narrative Frame
safety framing
Spin Score
40%
Emphasizes CISA’s responsive governance role while minimizing scrutiny of Microsoft’s and MikroTik’s development practices, disclosure timelines, or patch availability status.
What the story wants you to believe
That CISA’s intervention is the central, decisive event — making the story about coordinated defense rather than vendor failure or systemic risk.
What it makes harder to question
Why these flaws shipped unpatched, how long they remained unpatched, or whether responsible disclosure processes failed.
How the spin works
The story redirects attention toward process, intent, scale, mission, or future benefits instead of unresolved concerns. Watch for loaded terms such as actively exploited, in the wild, Known Exploited Vulnerabilities. The distribution reads as editorial reporting. A pressure point: Patch availability status for either vulnerability.
Who Benefits If This Frame Spreads
CISA
Reinforces institutional mandate and urgency of its KEV program.
Framing reinforces CISA’s role as the authoritative source of actionable threat intelligence, strengthening policy influence and budget justification.
The Frame
CISA as vigilant defender; vendors as passive subjects of oversight.
Missing Context
- Patch availability status for either vulnerability
- Whether exploits predate or postdate public disclosure
- Vendor statements or remediation timelines
SpinGraph
How this belief gets built
Claim → Frame → Beneficiary → Gap → AI Risk
The article frames the story around CISA’s authoritative response, turning attention toward government-led protection and away from questions about why the
- Claim
CISA added CVE-2026-65660 and a MikroTik RouterOS flaw to its
CISA added CVE-2026-65660 and a MikroTik RouterOS flaw to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation.
- Frame
Blame shifts elsewhere
CISA as vigilant defender; vendors as passive subjects of oversight.
- Beneficiary
institutional mandate and urgency of its KEV program
CISA — Reinforces institutional mandate and urgency of its KEV program.
- Gap
Patch availability status for either vulnerability
- AI Risk
AI may repeat the headline as fact
CISA added SharePoint and MikroTik vulnerabilities to its KEV catalog due to active exploitation.
Claim Ledger
| Claim | Evidence | Verification | Risk | Evidence Gaps |
|---|---|---|---|---|
| CISA added CVE-2026-65660 and a MikroTik RouterOS flaw to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation. | Direct attribution to CISA’s official action and stated rationale. | Claim Present in Source | High | Link to CISA’s KEV entry; Citation of underlying exploitation evidence (e.g., malware sample hash, IOC set, or report reference) |
CISA added CVE-2026-65660 and a MikroTik RouterOS flaw to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation.
evidence: Direct attribution to CISA’s official action and stated rationale.
"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation."
Evidence Gaps
- Link to CISA’s KEV entry
- Citation of underlying exploitation evidence (e.g., malware sample hash, IOC set, or report reference)
Fact Check Signals
0 of 1 claim matched · confidence: low · checked September 26, 2026
CISA added CVE-2026-65660 and a MikroTik RouterOS flaw to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation.
Language Heatmap
Loaded terms that carry the frame beyond the facts.
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Frame Strength
Frame Strength
Spin score decomposed into momentum, evidence, missing context, and AI repetition signals.
Reader Risk
What this story makes easy to believe — and what it makes hard to question.
Source Role & Intent
The Hacker News · Media
Counter-Frames
Brand Frame
CISA as vigilant defender; vendors as passive subjects of oversight.
Media / Reader Counter-Frame
Media may reframe as evidence of systemic software supply chain fragility or vendor negligence, especially if patches remain unavailable.
Regulatory Counter-Frame
Regulators may cite this as grounds for stricter secure-by-design mandates or enforcement against vendors with repeated KEV entries.
AI Summary Frame
AI may conflate 'active exploitation' with 'widespread compromise', or misattribute exploit authorship to nation-state actors without source basis.
Questions Not Answered
- Which threat actors are exploiting these flaws?
- What specific exploitation patterns or payloads have been observed?
- What is the estimated scope of affected deployments outside federal systems?
Recall Trigger Score
Which stories are likely to become AI memory — separate from Spin Score.
63
Trigger score 75
Triggered by: Regulator + AI · Security breach · Regulatory action
Tracked because: Regulator + AI · Security breach · Regulatory action
- chatgpt not found
- gemini not found
- perplexity found · Day 0
AI Recall
From publication to SpinGraph analysis to first observed AI recall and stable retention.
What AI Will Probably Repeat
"CISA added SharePoint and MikroTik vulnerabilities to its KEV catalog due to active exploitation."
Concern: AI may drop the nuance that KEV inclusion reflects CISA’s assessment—not independent forensic validation—and omit that CVSS scores reflect theoretical severity, not observed impact.
-
Published
Sep 26, 2026
-
Ingested
Sep 26, 2026
-
SpinGraph Created
Sep 26, 2026
-
First Observed AI Recall
Pending
Monitoring scheduled
-
Stable Recall
—
Awaiting retention signal
Recall Check Log
3 checks · last Sep 29, 2026 · tracking on
Sep 29, 2026
ChatGPT Not recalledGemini Not recalledSep 27, 2026
ChatGPT Not recalledGemini Not recalledSep 26, 2026
ChatGPT Not recalledGemini Not recalledPerplexity Recalled cites: windowsforum.com, securityaffairs.com…
─── GEOGrow AI Recall Layer ───
AI Recall Tracking
Monitoring scheduled. No LLM recall detected yet.
This story has not yet appeared in tested AI answers. Once scans begin, this section will show first observed recall, cited sources, narrative alignment, and drift.
node_id=sts_sharepoint_rce_and_mikrotik_routeros_flaws_activ
Ask AI about this story
Opens with the SpinGraph .md URL and structured context — one click, prompt included.
More from The Hacker News
View all →- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
- FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
- Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
- The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition
- ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
Markdown (.md) · JSON-LD schema (.json) · Machine-readable for AI & GEO