When CISA adds a vulnerability to its Known Exploited Vulnerabilities catalogue, it means attackers aren't just theorizing—they're actively using it. Two recent additions spotlight a dangerous combination: a SharePoint remote code execution flaw and a RouterOS weakness that threaten both corporate infrastructure and hosting providers alike.
The SharePoint Injection Problem
CVE-2026-65660 carries an 8.8 CVSS score, which in practical terms means an attacker with minimal preconditions can execute arbitrary code on a vulnerable SharePoint instance. Code injection vulnerabilities in collaboration platforms are particularly nasty because SharePoint often sits at the boundary between internal networks and the internet. For hosting operators running Windows-based VPS or dedicated servers that host SharePoint, this matters directly: a compromised customer instance becomes a potential pivot point into your infrastructure.
The vulnerability class—code injection rather than a simple authentication bypass—suggests that the flaw allows an attacker to inject and execute commands without necessarily having valid credentials first, though details on exact preconditions remain scarce. What's clear is that active exploitation means you cannot afford to treat this as theoretical. Patches need to deploy within hours, not weeks.
RouterOS and the Edge Problem
The MikroTik RouterOS flaw compounds the risk because routers sit upstream of everything. Compromising an edge device gives an attacker sight of all traffic flowing through it, and potentially a foothold to pivot into the infrastructure behind it. For managed service providers and hosting companies running their own network infrastructure, a RouterOS compromise represents a full infrastructure crisis—not just a single customer problem.
RouterOS deployments are ubiquitous in smaller datacenters and provider edge networks. Unlike enterprise firewalls that receive constant security attention, RouterOS devices sometimes languish on default credentials or behind a false sense of security from air-gapping. The appearance of this flaw in the CISA KEV catalogue means attackers have already validated the exploit and will be scanning for unpatched instances.
What Hosting Operators Should Do Now
If you operate Windows-based infrastructure hosting customer applications, audit your SharePoint deployments first. Note which instances are internet-facing and which sit behind a web application firewall. Prioritise patching those exposed instances within 24 hours. For internal-only SharePoint, the risk is lower but still significant—insider threats and lateral movement attacks can exploit unpatched systems.
For RouterOS, the situation demands more caution. If you operate MikroTik equipment in your network, assume attackers are already scanning for vulnerable versions. Pull the firmware version report for every device immediately and cross-reference against CVE databases. If any device is more than one minor version behind current releases, treat it as a priority. Consider deploying these devices behind a secondary firewall or VPN if they must remain in service whilst patches are staged.
Network segmentation becomes critical here. Even if you patch slowly, ensuring that RouterOS devices cannot directly communicate with backend infrastructure or customer data stores limits the blast radius of a compromise. Restrict management access to these devices to a hardened jump host or out-of-band management network.
The Broader Pattern
These two flaws highlight a recurring problem: infrastructure components are often treated as "set and forget" once deployed. SharePoint gets updated as part of monthly patch cycles, but RouterOS often doesn't, because it's considered too critical to reboot. Both assumptions lead to compromise. Active exploitation in the wild removes any margin for debate—patching must happen immediately, even if it requires a maintenance window.
Operators running dedicated servers or VPS with customer workloads should ensure patch management is auditable and automated where possible. Manual patch tracking at scale guarantees gaps. Build inventory of all internet-facing services and their patch status, and keep that list reviewed weekly until these specific vulnerabilities are closed everywhere they exist in your infrastructure.
