CISA KEV Alert: CVE-2026-65660 SharePoint Code Injection and CVE-2026-67279 MikroTik RouterOS Actively Exploited — Detection and Remediation Guide

On September 25, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild: CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint, and CVE-2026-67279, an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS.

This is not a drill. KEV inclusion means adversaries are exploiting these flaws against real targets right now. SharePoint remains one of the highest-value targets in enterprise environments — it holds sensitive documents, integrates deeply with Active Directory, and historically serves as a beachhead for lateral movement. MikroTik routers sit at the network edge, and compromised RouterOS devices have repeatedly been used to build botnets, proxy malicious traffic, and pivot into internal networks. If you run either product, treat this as an emergency change, not a routine patch cycle.

CISA's Binding Operational Directive (BOD) 26-04 — Prioritizing Security Updates Based on Risk — reinforces the KEV Catalog as the prioritization baseline for Federal Civilian Executive Branch (FCEB) agencies and requires rapid remediation of cataloged vulnerabilities. Even if you're not a federal agency, BOD deadlines are a useful forcing function: if it's urgent enough for the federal enterprise, it's urgent enough for yours.

Technical Analysis

CVE-2026-65660 — Microsoft SharePoint Code Injection

Affected product: Microsoft SharePoint Server (on-premises deployments; SharePoint Online in Microsoft 365 is managed by Microsoft and not the target of this advisory).

Vulnerability class: Code injection (CWE-94). Code injection flaws in SharePoint typically allow an attacker to execute arbitrary code in the context of the SharePoint application pool account — historically achieved through unsafe deserialization, server-side template injection, or abuse of the SharePoint page/widget rendering pipeline.

From a defender's perspective, the exploitation pattern for SharePoint code injection bugs is well established and matches what we've seen in prior SharePoint exploitation waves (ToolShell and related campaigns):

1. Initial access: An HTTP POST request targets a vulnerable SharePoint endpoint, frequently under /_layouts/ or a web service path.
2. Code execution: The payload executes under the IIS worker process (w3wp.exe) running the SharePoint application pool.
3. Webshell drop: Attackers commonly write ASPX webshells to the SharePoint LAYOUTS directory (C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\) to establish persistence that survives patching.
4. Post-exploitation: Theft of the SharePoint MachineKey (enabling forged ViewState/ASP.NET auth tickets), credential harvesting, and lateral movement via the farm service account's privileges.

Critical caveat for defenders: patching alone does not evict an attacker who has already dropped a webshell or stolen cryptographic material. If your SharePoint servers were internet-exposed and unpatched when this CVE hit KEV, assume compromise until proven otherwise. Hunt first, patch, then rotate the ASP.NET MachineKey and farm credentials.

CVE-2026-67279 — MikroTik RouterOS Improper Enforcement of Behavioral Workflow

Affected product: MikroTik RouterOS (RouterBOARD devices, CHR instances, and ISP/CPE deployments).

Vulnerability class: Improper enforcement of behavioral workflow (CWE-841). This class of flaw means the software fails to enforce its intended sequence of operations or state transitions — in practice, this frequently enables attackers to bypass authentication checks, escalate privileges, or invoke restricted functionality by calling operations out of order or skipping expected validation steps.

MikroTik's history makes this especially dangerous. RouterOS devices have been mass-exploited for years (Chimay Red, VPNFilter, Meris botnet) precisely because they're edge devices with huge internet-exposed footprints, often running outdated firmware with the management interface reachable from the WAN. Typical post-exploitation behavior on compromised RouterOS includes:

• Adding rogue admin users or enabling API/API-SSL services
• Modifying firewall NAT rules to proxy traffic (SOCKS proxy abuse)
• Creating scheduled scripts (/system scheduler) for persistence
• DNS hijacking by altering router DNS settings to redirect victim traffic
• Using the device as a pivot point into internal networks it fronts

Exploitation Status

Both entries are cataloged in the CISA KEV Catalog, which establishes remediation due dates for FCEB agencies under BOD 26-04. Check the KEV entry for each CVE for the specific due date — recent KEV additions for internet-facing edge and collaboration products have carried aggressive timelines.

Detection & Response

Sigma Rules

The following rules target the post-exploitation behaviors most consistently observed when SharePoint code injection flaws are weaponized: the IIS worker process spawning command interpreters, and webshells being written to SharePoint directories. These are high-signal detections — w3wp.exe spawning cmd.exe or PowerShell in a SharePoint context is almost never legitimate outside of a narrow set of admin tools.

---
title: SharePoint IIS Worker Process Spawning Command Shell or Script Interpreter
id: 9b2c4d71-6a3e-4f58-b1c7-2e8d9f0a3b45
status: experimental
description: Detects w3wp.exe hosting SharePoint spawning cmd.exe, PowerShell, or other script interpreters — a hallmark of SharePoint code injection exploitation such as CVE-2026-65660 used for webshell deployment and post-exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate SharePoint administrative tooling; investigate parent app pool identity and command line before dismissing
level: high
---
title: Webshell or ASPX File Written to SharePoint LAYOUTS Directory
id: 4f7a1e93-8c2d-4b6a-9d51-7f3e0a2c6b18
status: experimental
description: Detects file creation of script content (ASPX, ASHX, ASP) in the SharePoint TEMPLATE LAYOUTS or site directories, consistent with webshell deployment following exploitation of CVE-2026-65660.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\inetpub\wwwroot\wss\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate SharePoint solution deployments (WSP installs) — correlate with change windows; outside a deployment window this is high signal
level: high

KQL — Microsoft Sentinel / Defender

Hunt for SharePoint exploitation behavior across your endpoint telemetry, and MikroTik management-plane anomalies via ingested Syslog/CEF. The MikroTik query catches two of the most common post-compromise actions: new user creation and configuration changes sourced from unexpected addresses.

// Hunt 1: SharePoint w3wp.exe spawning suspicious child processes (CVE-2026-65660 post-exploitation)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe",
                     "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
                     "whoami.exe", "net.exe", "nltest.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt 2: Script file writes into SharePoint LAYOUTS directories (webshell staging)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("Web Server Extensions\\15\\TEMPLATE\\LAYOUTS", "Web Server Extensions\\16\\TEMPLATE\\LAYOUTS", "inetpub\\wwwroot\\wss")
| where FileName endswith_any (".aspx", ".ashx", ".asmx", ".asp", ".php")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: MikroTik RouterOS anomalies — new users, scheduler/script changes, config edits (CVE-2026-67279)
// Assumes RouterOS remote logging into Sentinel via Syslog/CEF
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("user added", "script", "scheduler", "api", "www-ssl", "winbox", "dns set", "nat")
| where SyslogMessage has_any ("added", "changed", "enabled", "created")
| project TimeGenerated, HostIP, Computer, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3b (CEF ingestion variant)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor has "MikroTik" or DeviceProduct has "RouterOS"
| where Message has_any ("user added", "scheduler", "script added", "api enabled", "dns set")
| project TimeGenerated, SourceIP, DestinationIP, Message
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts for webshells in SharePoint content directories and suspicious child processes of the IIS worker process — useful for sweeping a SharePoint fleet quickly to determine whether exploitation preceded patching.

-- Hunt: SharePoint webshell artifacts and w3wp suspicious children
-- Scope: SharePoint servers; look for recently written script files in LAYOUTS and odd IIS child processes

-- Part 1: Recently created/modified script files in SharePoint directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/*.aspx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/*.ashx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/15/TEMPLATE/LAYOUTS/*.aspx',
  'C:/inetpub/wwwroot/wss/**/*.aspx'
])
WHERE Mtime > timestamp(epoch=1788800000)  -- adjust to just before your patch/Kev-add date
ORDER BY Mtime DESC;

-- Part 2: w3wp.exe processes with suspicious command lines or children
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'w3wp'
   OR (CommandLine =~ 'powershell|cmd.exe|certutil|bitsadmin|rundll32'
       AND Exe =~ 'w3wp|SharePoint')

Verification and Hardening Scripts

# SharePoint: Verify farm build, inventory recent LAYOUTS writes, and audit IIS child processes
# Run elevated on each SharePoint server in the farm

# 1) Report current SharePoint build — compare against the fixed build in Microsoft's CVE-2026-65660 advisory
$spVer = Get-SPProduct -Local 2>$null
if ($spVer) { $spVer | Select-Object ProductName, PatchStatus, InstallDate | Format-List } else {
    Write-Host 'Get-SPProduct unavailable — run in SharePoint Management Shell' -ForegroundColor Yellow
}

# 2) Sweep LAYOUTS and inetpub for recently written script files (potential webshells)
$cutoff = (Get-Date).AddDays(-30)
$paths = @(
  'C:
ogram Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS',
  'C:
ogram Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS',
  'C:
etpub\wwwroot\wss'
) | ForEach-Object { $_.Replace('rogram','Program').Replace('netpub','inetpub') }
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff } |
      Select-Object FullName, LastWriteTime, CreationTime, Length
  }
}

# 3) Rotate the ASP.NET MachineKey AFTER patching and confirming clean — stolen keys enable forged auth tickets
#    (Coordinate with a maintenance window; invalidates existing sessions)
Write-Host 'REMINDER: After patching, rotate MachineKeys on all farm servers and restart IIS (iisreset).' -ForegroundColor Cyan
Write-Host 'REMINDER: Reset the SharePoint farm account and any managed service account credentials.' -ForegroundColor Cyan

# MikroTik RouterOS: post-exploitation audit — run via SSH against each device
# Adjust device list and credentials; capture output for IR review

for RTR in 192.0.2.10 192.0.2.11; do
  echo "===== $RTR ====="
  ssh admin@$RTR "/system resource print; /system package print"            # RouterOS version — compare to fixed release in MikroTik advisory
  ssh admin@$RTR "/user print detail"                                       # Look for unknown/rogue admin accounts
  ssh admin@$RTR "/system scheduler print detail; /system script print detail"  # Persistence via scheduled scripts
  ssh admin@$RTR "/ip service print"                                        # Ensure api/api-ssl/www/winbox are WAN-disabled
  ssh admin@$RTR "/ip firewall nat print; /ip socks print"                  # Proxy/NAT hijack indicators
  ssh admin@$RTR "/ip dns print"                                            # DNS hijack check — verify expected servers
  ssh admin@$RTR "/log print where topics~\"critical|error\""               # Auth anomalies and config change entries
done

# Baseline hardening after verification:
#  - Upgrade RouterOS to the fixed version per MikroTik's CVE-2026-67279 advisory
#  - Restrict management interfaces to a dedicated management VRF/VLAN and ACL trusted source IPs
#  - Disable unused services (api, api-ssl, ftp, telnet, www if unused)
#  - Rotate all device credentials and any credentials traversing the router if compromise is suspected

Remediation

CVE-2026-65660 — Microsoft SharePoint

1. Apply Microsoft's security update immediately. Obtain the patch for CVE-2026-65660 via the Microsoft Security Update Guide and Microsoft's advisory for this CVE. Verify the installed build on every farm server — partially patched farms are compromised farms.
2. Meet the BOD 26-04 deadline. FCEB agencies must remediate by the due date specified in the KEV Catalog entry. Private sector: use that same date as your internal SLA.
3. Hunt before and after patching. Run the Sigma, KQL, and VQL content above. Patching closes the door but does not remove webshells or invalidate stolen MachineKeys.
4. Rotate secrets on any server that was exposed while vulnerable: ASP.NET MachineKeys (all farm servers), the farm service account, managed service accounts, and any credentials stored in SharePoint service applications.
5. Reduce exposure: SharePoint should never be directly internet-facing without a hardened reverse proxy/WAF in front. Enforce TLS, restrict /_layouts/ access where feasible, and enable AMSI integration for SharePoint (available in supported versions) to catch in-memory webshell execution.

CVE-2026-67279 — MikroTik RouterOS

1. Upgrade RouterOS to the fixed release per MikroTik's advisory for CVE-2026-67279, available from mikrotik.com/download and MikroTik's security announcements. Reboot and verify the running version.
2. Audit before trusting: compromised RouterOS devices frequently contain rogue users, scheduled scripts, NAT/SOCKS proxies, and hijacked DNS. Firmware upgrade does not remove attacker-added configuration. Run the audit script above; if indicators are present, factory-reset and restore from a known-good configuration export taken before the exposure window.
3. Lock down the management plane: disable management from WAN interfaces entirely; restrict Winbox/SSH/API to a management VLAN with source IP ACLs; disable unused IP services.
4. Rotate credentials on all potentially affected devices, and review downstream systems if the router fronted internal networks — treat it as a potential pivot point.
5. Enable remote syslog to your SIEM (the KQL hunts above assume this) — RouterOS local logs are wiped on reboot and are the first thing attackers clear.

Program-Level Actions

• Feed the KEV into your vulnerability management SLA. BOD 26-04 formalizes what mature programs already do: KEV-listed CVEs bypass normal patch cadence and get emergency-change treatment.
• Inventory is the prerequisite. You cannot patch the SharePoint farm or the MikroTik CPE fleet you don't know you have. Reconcile asset inventory against KEV additions within 24 hours of each catalog update.
• Validate edge device posture continuously. Both of these CVEs target perimeter-adjacent infrastructure. External attack surface monitoring should flag any SharePoint or RouterOS management interface exposed to the internet.

The pattern here is familiar to anyone who's worked IR in the last several years: collaboration platforms and edge network devices are the front door. CISA has done the prioritization work for you — the only remaining variable is how fast your organization executes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub