CISA Adds Two Known Exploited Vulnerabilities to Catalog

On 25 September 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog because it had evidence they were already being used in attacks. The primary source is CISA’s alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog.

• CVE-2026-65660, a code-injection flaw in Microsoft SharePoint.
• CVE-2026-67279, an improper workflow flaw in MikroTik RouterOS.

CISA describes this class of bug as a frequent path in for attackers and a serious risk to federal networks. A KEV listing is not a severity score. It is a statement that exploitation has been observed, so the patch moves ahead of vulnerabilities that are still only theoretical.

What the two entries are

CVE-2026-65660 is SharePoint code injection. Microsoft’s update guide classifies it as improper control of code generation (CWE-94): an authenticated attacker on the network can spoof content that SharePoint then treats as trusted. The advisory lists SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Install the security update for the build you actually run, then confirm the farm is on the fixed build rather than assuming the installer finished.

CVE-2026-67279 is in MikroTik RouterOS SSH. The vulnerability record describes a pre-authentication rekey path. The server moves into the SSH connection protocol after a client-requested rekey even though the user never authenticated. An unauthenticated client can open a session and send a command that creates or overwrites files in RouterOS’s managed file area, including support files that hold configuration and diagnostics. The record says the fix shipped in RouterOS 6.49.21 (long-term), 7.23.4 (long-term), and 7.24.2 (stable). A device that cannot be upgraded immediately should not leave SSH, TCP port 22, reachable from the internet.

What BOD 26-04 changes

Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, is the vulnerability-management rule for Federal Civilian Executive Branch agencies. It keeps the KEV catalog at the center of that process. Agencies are told to patch high-risk issues first, especially KEV entries on assets that are exposed to the internet and that give an attacker full control after exploitation. Lower-risk vulnerabilities can wait. The directive also sets a baseline for checking whether an attacker was already inside before the patch was applied.

BOD 26-04 binds those federal agencies only. CISA still asks every other organization to manage vulnerabilities by risk and to put KEV entries at the front of the queue. New entries are added when a CVE has evidence of exploitation and a clear way to mitigate it. A proof of concept, on its own, is not the same thing as evidence that someone has used the bug.

What to do with these two

1. Find SharePoint 2016, 2019, and Subscription Edition farms, and every RouterOS device, including the ones that never made it into the inventory.
2. Patch SharePoint from Microsoft’s update for CVE-2026-65660. Move RouterOS to 6.49.21, 7.23.4, 7.24.2, or a later fixed release on that branch.
3. If a RouterOS device exposed SSH before the upgrade, review its files and accounts. The flaw allows unauthenticated writes, so a version bump does not tell you whether a file was already changed.
4. On SharePoint, check which accounts could have reached the vulnerable component, and look for content changes around the week of the alert.
5. Write down the date you are patching to. Federal teams have a directive. Everyone else still needs a date, or the entry sits in a ticket with no owner.

If a KEV entry is missing

CISA asks anyone who knows of an exploited vulnerability that is not in the catalog to send it through the KEV nomination form. A nomination needs a CVE ID, evidence that it has been exploited, and clear mitigation steps. A suspicion does not meet that bar.

Track the catalog itself at cisa.gov/known-exploited-vulnerabilities-catalog. This note is a reading of the 25 September 2026 alert and the two vendor records. Patch steps should come from those pages, not from a summary.