CVE-2026-65660: Microsoft SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited — CISA KEV Detection and Remediation Guide

On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild: CVE-2026-65660, a code injection vulnerability in Microsoft Office SharePoint with a CVSS score of 8.8, and a separate flaw affecting MikroTik RouterOS. When CISA moves vulnerabilities into the KEV catalog, it is not a theoretical exercise — it is confirmation that threat actors are already using these bugs against real targets, and that the window for proactive patching has closed.

For defenders, this dual listing matters on two fronts. SharePoint remains one of the most frequently targeted enterprise collaboration platforms — internet-facing on-premises SharePoint servers have been a recurring initial-access vector for both ransomware affiliates and nation-state operators. MikroTik routers, meanwhile, sit at the network edge of countless SMBs, ISPs, and branch offices, and compromised RouterOS devices have historically been folded into botnets, used as SOCKS proxy relays for C2 obfuscation, and leveraged as beachheads for lateral movement. If you run either product, treat this as an incident-response scenario, not a routine patch cycle: apply fixes immediately, then hunt for evidence of prior compromise.

Technical Analysis

CVE-2026-65660 — Microsoft SharePoint Code Injection (CVSS 8.8)

CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint. Code injection flaws in SharePoint typically arise from insufficient input validation or unsafe deserialization in server-side components, allowing an attacker to inject and execute arbitrary code in the context of the SharePoint web application pool process (w3wp.exe) and the SharePoint service account.

Key defensive considerations for this class of vulnerability:

• Attack surface: On-premises SharePoint servers are the primary concern, particularly those directly exposed to the internet or reachable from less-trusted network segments. SharePoint Online (Microsoft 365) is managed and patched by Microsoft and is not the target here.
• Exploitation requirements: At CVSS 8.8 (high, but not critical), exploitation likely requires some level of authenticated access or user-level privileges against the SharePoint application — but this provides little comfort in practice. Attackers routinely pair these flaws with credential theft, session hijacking, or chained vulnerabilities, and in hybrid environments a single phished credential can be sufficient.
• Post-exploitation behavior: Successful code execution on SharePoint historically leads to web shell deployment (ASPX files dropped into the SharePoint LAYOUTS or TEMPLATE directories), child processes spawned from w3wp.exe (cmd.exe, PowerShell, certutil), credential dumping from the application host, and pivoting into the broader domain — SharePoint servers frequently hold highly privileged service accounts and trusted connections to SQL backends.
• Exploitation status: Confirmed active exploitation per CISA KEV listing. This is not a proof-of-concept scenario.

MikroTik RouterOS Flaw

The second KEV addition affects MikroTik RouterOS, the operating system powering MikroTik routers and switches deployed extensively at network edges, in ISP infrastructure, and across SMB environments. MikroTik exploitation campaigns in recent years have consistently followed a recognizable playbook: compromise the router via an unpatched vulnerability or weak management-plane exposure (Winbox on TCP/8291, the API on TCP/8728/8729, or webfig), then add malicious scheduled tasks and scripts under /system script and /system scheduler, enable hidden SOCKS proxies for traffic relay, create backdoor user accounts, and modify DNS or firewall rules for persistence and interception.

Because RouterOS devices sit upstream of everything behind them, a compromised router is a man-in-the-middle position by default. Attackers use them to relay C2 traffic, intercept credentials, and stage further intrusions — and most organizations have no endpoint telemetry whatsoever on their routers, which makes these devices ideal long-term persistence points.

Exploitation status for both flaws: Actively exploited in the wild; listed in the CISA KEV catalog. Under Binding Operational Directive 22-01, federal civilian executive branch agencies are required to remediate KEV-listed vulnerabilities on CISA's published timeline (typically within three weeks of catalog addition). Private-sector organizations should adopt the same urgency.

Detection & Response

The detections below target the observable behaviors that matter: code execution emanating from the SharePoint worker process, web shell deployment into SharePoint directories, and anomalous RouterOS configuration and script activity. Tune thresholds to your baseline, but do not disable the w3wp.exe child-process rule — legitimate SharePoint almost never spawns interactive shells, and this is one of the highest-fidelity signals available.

Sigma Rules

---
title: SharePoint Worker Process Spawning Suspicious Child Process
id: 3f8c2a91-6d47-4e5b-9a21-c7e04f1b88d2
status: experimental
description: Detects cmd.exe, PowerShell, or other LOLBins spawned by the IIS worker process hosting SharePoint (w3wp.exe), consistent with post-exploitation of a SharePoint code injection flaw such as CVE-2026-65660.
references:
  - https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/27
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  filter_apppool:
    CommandLine|contains:
      - 'MSExchange'  # Exchange co-resident pools may spawn shells legitimately; review per environment
  condition: selection_parent and selection_child and not filter_apppool
falsepositives:
  - SharePoint solutions or custom web parts that legitimately invoke external processes (rare; validate against application inventory)
level: high
---
title: Web Shell File Creation in SharePoint Server Directories
id: 91d4e6b2-2c58-4a7f-b3d9-5e8f0a1c77e3
status: experimental
description: Detects creation of script files (ASPX, ASP, ASHX) in SharePoint LAYOUTS/TEMPLATE directories by non-standard processes, indicating web shell deployment following SharePoint exploitation.
references:
  - https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/27
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Microsoft Shared\Web Server Extensions\'
      - '\TEMPLATE\LAYOUTS\'
      - '\TEMPLATE\CONTROLTEMPLATES\'
      - '\inetpub\wwwroot\wss\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
  filter_legit:
    Image|endswith:
      - '\setup.exe'
      - '\msiexec.exe'
      - '\psconfig.exe'
      - '\psconfigui.exe'
  condition: selection_path and selection_ext and not filter_legit
falsepositives:
  - Legitimate SharePoint solution (WSP) deployments and cumulative update installations - correlate with maintenance windows
level: high
---
title: MikroTik RouterOS Management Plane Access from Untrusted Source
id: b72a9c44-8f13-4d6e-a5c8-2e9d1b0f34a7
status: experimental
description: Detects connections to MikroTik Winbox (8291) or RouterOS API (8728/8729) services from non-management-network sources, a common precursor and post-exploitation behavior in RouterOS compromise campaigns.
references:
  - https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
  - https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/09/27
tags:
  - attack.initial_access
  - attack.t1133
logsource:
  category: firewall
  product: network
detection:
  selection:
    dst_port:
      - 8291
      - 8728
      - 8729
  filter_mgmt:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_mgmt
falsepositives:
  - ISP-managed CPE scenarios where upstream providers legitimately manage devices - whitelist known provider ranges
level: high

KQL Hunt — Microsoft Sentinel / Defender

The first query hunts SharePoint post-exploitation process chains in Defender for Endpoint. The second hunts RouterOS management-plane anomalies via Syslog/CEF ingestion — MikroTik devices can forward logs to a syslog collector, and any environment ingesting those into Sentinel can run this.

// Hunt 1: Suspicious child processes of SharePoint/IIS worker process
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","whoami.exe","net.exe","nltest.exe","cscript.exe","wscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName, ReportId
| order by TimeGenerated desc

// Hunt 2: Web shell files written to SharePoint directories
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("Web Server Extensions", "LAYOUTS", "CONTROLTEMPLATES")
| where FileName endswith_any (".aspx", ".ashx", ".asmx", ".asp")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "psconfig.exe", "psconfigui.exe", "setup.exe", "TiWorker.exe")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 3: RouterOS syslog anomalies - script/scheduler/user changes and login failures
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("script", "scheduler", "user added", "logged in", "login failure", "socks", "fetch")
| where Computer has_any ("mikrotik", "routeros") or ProcessName has_any ("mikrotik", "routeros")
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL — Endpoint Forensic Hunt

Run this against your SharePoint server fleet to identify web shells and suspicious worker-process children in one sweep:

-- SharePoint post-exploitation sweep: web shell files + suspicious w3wp children
LET webshells = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/*.aspx',
                 'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/*.ashx',
                 'C:/inetpub/wwwroot/wss/**/*.aspx'])
WHERE Btime > ago(30d)

LET children = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(cmd|powershell|pwsh|mshta|rundll32|certutil|net|whoami)'

SELECT * FROM webshells

Follow up on any hits by collecting the file content (look for obfuscated eval patterns, base64 blobs, or Process.Start calls in ASPX) and pivoting into the children result with parent-PID correlation against w3wp.exe. In production, deploy this as a multi-artifact hunt combining Windows.Forensics.WebShells logic with process ancestry via Windows.System.Pstree.

Remediation & Verification Script — SharePoint

# CVE-2026-65660 SharePoint verification and hardening script
# Run elevated on each SharePoint server

# 1. Identify SharePoint build - compare against the fixed build in Microsoft's advisory
$spVer = (Get-SPProduct -Local).Servers | Select-Object ServerName, Version, InstallStatus
$spVer | Format-Table -AutoSize

# 2. Confirm the applicable security update is installed
# Check installed SharePoint-related hotfixes from the last 90 days
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-90) } |
  Select-Object HotFixID, Description, InstalledOn | Sort-Object InstalledOn -Descending

# 3. Sweep for recently created script files in SharePoint hive (web shell triage)
$hivePaths = @(
  "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions",
  "C:\inetpub\wwwroot\wss"
)
foreach ($p in $hivePaths) {
  Get-ChildItem -Path $p -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-60) } |
    Select-Object FullName, CreationTime, LastWriteTime, Length |
    Sort-Object CreationTime -Descending
}

# 4. Audit IIS worker process for unexpected child processes (last 7 days, if process auditing enabled)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'w3wp.exe' -and $_.Message -match 'cmd.exe|powershell.exe|mshta.exe|certutil.exe' } |
  Select-Object TimeCreated, Message

# 5. Reduce attack surface while patching is staged
# Block external access to SharePoint at the perimeter if business permits, and
# enforce MFA + conditional access for any federated SharePoint auth path

MikroTik RouterOS Verification Commands

# SSH into each RouterOS device and run:

# 1. Check RouterOS version against the fixed release in MikroTik's advisory
/system resource print
/system package update print

# 2. Enumerate local users - look for unknown/backdoor accounts
/user print detail

# 3. Review scripts and scheduled tasks - attacker persistence lives here
/system script print detail
/system scheduler print detail

# 4. Check for hidden SOCKS proxy and proxy enablement (C2 relay indicator)
/ip socks print
/ip proxy print

# 5. Review firewall and NAT rules for unauthorized redirects or port forwards
/ip firewall nat print
/ip firewall filter print

# 6. Verify management plane is not internet-exposed
/ip service print
# winbox (8291), api (8728), api-ssl (8729), www/ssh should be bound to management
# addresses only via /ip service set address=<mgmt_cidr>

Remediation

Priority 1 — Microsoft SharePoint (CVE-2026-65660):

1. Apply Microsoft's security update immediately. Review the official advisory at the Microsoft Security Response Center update guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660. Identify your SharePoint version (2016, 2019, or Subscription Edition), download the corresponding security update, and deploy during the earliest available maintenance window — do not wait for the next Patch Tuesday cycle.
2. Patch every node in the farm, not just front-end servers. Run the SharePoint Products Configuration Wizard (psconfig) after installation to complete the update.
3. Assume breach. Because exploitation predates the KEV listing, run the detection content above against at least 30 days of telemetry. Web shells dropped weeks ago do not disappear because you patched today.
4. Reduce exposure: If SharePoint is internet-facing without a hard business requirement, place it behind a VPN or application proxy. Enforce MFA on all SharePoint authentication paths and review service account privileges — SharePoint farm accounts should not be domain admins.
5. Rotate credentials for SharePoint service accounts and any interactive accounts that logged onto the servers if any suspicious artifact is found.

Priority 2 — MikroTik RouterOS:

1. Upgrade RouterOS to the latest patched release from the official MikroTik download page: https://mikrotik.com/download. Verify the version against MikroTik's security advisory covering this flaw before and after upgrade.
2. Lock down the management plane: Disable Winbox, API, and webfig from WAN interfaces entirely; restrict management services to a dedicated management VLAN/CIDR via /ip service set address=. Never expose port 8291 to the internet.
3. Audit persistence: Run the RouterOS verification commands above. Attackers who have owned a router frequently survive a firmware upgrade via /system script + scheduler combinations — if you find unauthorized scripts, scheduler entries, users, or SOCKS configuration, factory-reset and reconfigure from a known-good backup rather than cleaning in place.
4. Rotate all credentials stored on or transiting the device, including SNMP communities, VPN secrets, and any upstream credentials.
5. Enable syslog forwarding to your SIEM so RouterOS configuration changes and login events become visible going forward — routers without telemetry are blind spots by design.

CISA KEV compliance: Both vulnerabilities are now subject to CISA's Known Exploited Vulnerabilities remediation requirements. Federal agencies must remediate per BOD 22-01 timelines; private organizations should treat the KEV due date as their own internal SLA. Track both entries at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.

Conclusion

Two KEV additions in one announcement, spanning an enterprise collaboration platform and ubiquitous edge routing hardware, is a reminder that initial access brokers work both sides of the perimeter. The SharePoint flaw gives attackers code execution inside your network; the RouterOS flaw gives them a position on top of it. Patch both, but more importantly, hunt on the assumption that exploitation began before the public disclosure — because with KEV-listed vulnerabilities, it always did. If your team lacks the telemetry or cycles to run these hunts across your SharePoint farm and edge devices, that gap itself is the finding worth escalating to leadership this week.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub