SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows -...

VulnCheck KEV: CVE-2026-65660

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network...

CVE-2026-69904

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-69804

Time-of-check time-of-use toctou race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69724

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69690

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69683

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-69636

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-69615

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69464

Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-69465

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69417

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69409

Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-69282

Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69273

Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69465

Microsoft Office SharePoint is affected by a missing authorization flaw that allows an authorized attacker to execute code over a network (remote code execution). The Microsoft CNA rates the severity as CVSS 3.1 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning exploitatio...

CVE-2026-69636

CVE-2026-69636 is an SQL injection vulnerability in Microsoft Office SharePoint , caused by improper neutralization of special elements used in SQL commands. An authorized attacker with low privileges can exploit it over a network to disclose information , with high confidentiality impact but no ...

EUVD-2026-73715

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

EUVD-2026-73712

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69464

Microsoft Office SharePoint contains an elevation of privilege vulnerability characterized as execution with unnecessary privileges. An authorized attacker with low privileges can exploit this over a network to escalate their access, with high impact on confidentiality, integrity, and availabilit...