On Friday September 25, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog, the list reserved for flaws confirmed to be under attack in the real world, with a fix deadline of September 28 for US federal agencies. One of them deserves a moment of attention from small businesses, because the affected product is the kind of hardware that sits in a closet nobody opens.
What was added
CVE-2026-67279 is a flaw in the SSH implementation of MikroTik RouterOS. An unauthenticated attacker can bypass the normal authentication flow, open a session channel and send commands. No password, no stolen credential, no phishing step. CERT Polska reported successful attacks against internet-exposed RouterOS devices going back to at least September 2, using a chain nicknamed MikroTrick.
The second addition, CVE-2026-65660, is a code-injection flaw in Microsoft SharePoint Server affecting the 2016, 2019 and Subscription Edition releases, exploitable by an authenticated low-privileged user. Note the word Server: if your team uses SharePoint through Microsoft 365, this is not your problem. If you still run SharePoint on a machine in your office, it is.
Why MikroTik matters more than it sounds
MikroTik gear is inexpensive, genuinely capable, and everywhere. It shows up in small offices, retail sites, clinics, warehouses, and in a lot of installs done by small internet providers and independent technicians. It is also the classic example of equipment that was configured competently once, years ago, by someone who has since moved on. Nobody owns it, so nobody updates it, and it keeps working, which is exactly why it goes unnoticed.
The real problem is not the flaw
Every device eventually has a vulnerability. What turned this one into active exploitation is that the SSH service was reachable from the open internet. Management interfaces, whether SSH, a web admin page or a vendor app, have no business being exposed to the whole world. When they are, a single bug becomes a door. Get that right and most future router vulnerabilities become something you patch on a normal schedule instead of an emergency.
What to actually do
- Find out what your edge device actually is, and write it down. Make, model, firmware version, who is responsible for updating it. If nobody can answer that, you have found the real issue.
- Close management access to the internet. Administration should be reachable from inside your network or over a VPN, never from any address on the planet.
- Update RouterOS if you run MikroTik, and check whether the device has been reachable over SSH from outside. If it has, assume it needs a look rather than a shrug.
- Patch SharePoint Server if you run it on premises. SharePoint in Microsoft 365 is unaffected by this one.
- Put network gear in your patching routine. Firewalls, switches, access points and cameras need the same patching discipline as laptops, and they are usually the last thing anyone checks.
- Ask your IT provider who covers this. Plenty of agreements quietly cover computers and not the network. Ask directly and get the answer in writing.
The takeaway
The lesson of this one is not really about MikroTik. It is that the boxes holding your network together are the least-managed computers in most small businesses, and attackers have noticed. Knowing what you have at the edge, keeping its admin interface off the public internet, and having a named owner for its updates handles the great majority of this category of risk.