CISA Warns of Active Exploitation: Critical Flaws in SharePoint, Elementor WordPress, and MikroTik RouterOS

Featured image: Photo by Ann H on Pexels.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued urgent warnings regarding several critical security vulnerabilities that are actively being exploited in the wild. This alert emphasizes the immediate need for organizations to patch and secure their systems against threats targeting widely used platforms: Microsoft SharePoint, the Elementor Website Builder WordPress plugin, and MikroTik RouterOS. The inclusion of these flaws in CISA’s Known Exploited Vulnerabilities (KEV) catalog signifies a clear and present danger, indicating that these are not merely theoretical risks but vulnerabilities actively leveraged by malicious actors to compromise networks and data.

The KEV catalog serves as a crucial resource for federal agencies and, by extension, all organizations, highlighting vulnerabilities for which there is definitive evidence of active exploitation. When CISA adds a vulnerability to this list, it mandates federal agencies to patch their systems within a specified timeframe, underscoring the severity and urgency of the threat. The recent additions underscore a persistent challenge in cybersecurity: attackers are swift to weaponize newly discovered flaws, often before many organizations have had the chance to implement necessary security updates.

Microsoft SharePoint Code Injection Vulnerability

One of the critical flaws highlighted by CISA is a code injection vulnerability in Microsoft Office SharePoint, identified as CVE-2026-65660 [2]. This vulnerability carries a high CVSS score of 8.8, reflecting its significant potential impact. A code injection flaw allows an attacker to introduce malicious code into a legitimate application, which the application then executes. In the context of SharePoint, this can lead to severe consequences, including remote code execution (RCE).

Remote code execution vulnerabilities are among the most dangerous as they can grant an unauthenticated attacker the ability to run arbitrary code on the affected server. For organizations relying on SharePoint for collaboration, document management, and internal communications, an exploited RCE vulnerability can translate to complete compromise of sensitive data, unauthorized access to corporate networks, and the potential for widespread disruption. Attackers could steal confidential information, inject malware, or establish persistent backdoors for future access. CISA’s warning about its active exploitation means that threat actors are already successfully leveraging this flaw to breach systems, making immediate patching paramount for any organization utilizing vulnerable SharePoint installations [2], [4].

MikroTik RouterOS Flaws Under Active Exploitation

In addition to SharePoint, CISA has also flagged security flaws impacting MikroTik RouterOS, citing evidence of active exploitation [2]. MikroTik routers are widely used globally, from small businesses to large enterprises and internet service providers, due to their robust feature set and cost-effectiveness. The operating system, RouterOS, powers these devices, making any vulnerability within it a significant concern for network security.

Routers are the gatekeepers of networks, controlling traffic flow and acting as the first line of defense against external threats. A compromise of a MikroTik router running a vulnerable RouterOS version can have far-reaching implications. Attackers could gain unauthorized access to internal networks, redirect traffic, eavesdrop on communications, launch further attacks against internal systems, or even use the compromised router as a pivot point for broader malicious campaigns. Given their critical position in network infrastructure, the active exploitation of MikroTik RouterOS vulnerabilities necessitates immediate attention. Organizations must ensure their MikroTik devices are running the latest, patched versions of RouterOS and adhere to best practices for router security, including strong administrative passwords, disabling unnecessary services, and implementing strict firewall rules.

Elementor WordPress Plugin Vulnerability

The popular Elementor Website Builder plugin for WordPress is another critical target highlighted by recent security advisories. A high-severity cross-site request forgery (CSRF) vulnerability has been identified, which, while not yet assigned a CVE identifier, carries a CVSS score of 8.8 [1]. This flaw could be exploited by an unauthenticated attacker to create rogue administrator accounts on affected WordPress sites [1], [3].

A CSRF vulnerability works by tricking an authenticated user into unknowingly executing an unwanted action. In the case of the Elementor flaw, an attacker could craft a malicious link or embed malicious code on a web page. If a legitimate site administrator, while logged into their WordPress dashboard, clicks this crafted link or visits the malicious page, the attacker could exploit their authenticated session to create a new administrator account. Once a rogue administrator account is created, the attacker gains full control over the WordPress site, enabling them to alter content, inject malware, redirect visitors, steal data, or deface the website. This level of access can be devastating for businesses and individuals relying on their WordPress sites for their online presence and operations.

The prevalence of WordPress and the widespread use of Elementor make this vulnerability particularly dangerous. Many websites, from personal blogs to e-commerce platforms, could be at risk. The ease with which an unauthenticated attacker can gain administrative privileges underscores the urgency for Elementor users to ensure their plugin is updated to a patched version. Regularly checking for and applying updates for all WordPress core files, themes, and plugins is a fundamental cybersecurity practice that can prevent such compromises.

Proactive Measures for Enhanced Cybersecurity

The active exploitation of these diverse vulnerabilities across SharePoint, MikroTik RouterOS, and Elementor WordPress highlights a critical need for organizations to adopt a proactive and comprehensive approach to cybersecurity. Relying solely on reactive measures is insufficient in today’s threat landscape. Several key strategies can significantly bolster an organization’s defense posture:

Firstly, **patch management** must be a top priority. For vulnerabilities listed in CISA’s KEV catalog, patching should be treated as an emergency. Organizations must establish robust processes for identifying, testing, and deploying security updates across all their software and hardware assets, including operating systems, applications, plugins, and network devices. Automated patching solutions can help streamline this process and reduce the window of vulnerability.

Secondly, **strong authentication** practices are essential. Implementing multi-factor authentication (MFA) for all administrative accounts and critical systems adds an extra layer of security, making it significantly harder for attackers to gain access even if they manage to compromise credentials. For WordPress sites, this includes implementing MFA for all user roles, especially administrators.

Thirdly, **network segmentation** can limit the blast radius of a successful attack. By dividing a network into smaller, isolated segments, organizations can prevent an attacker who has compromised one part of the network from easily moving laterally to other critical systems. This strategy is particularly relevant for environments where devices like routers or internal servers might be targeted.

Fourthly, **regular security audits and penetration testing** are crucial. These proactive assessments can help identify vulnerabilities before attackers do, allowing organizations to remediate weaknesses in their infrastructure, applications, and configurations. This includes scanning for known vulnerabilities and simulating real-world attack scenarios.

Finally, **employee training and awareness** play a vital role. Many attacks, especially those leveraging CSRF or phishing, rely on human error. Educating employees about common attack vectors, recognizing suspicious emails or links, and adhering to security best practices can significantly reduce the likelihood of a successful compromise. A security-conscious culture is a powerful defense mechanism against evolving threats.

The warnings from CISA serve as a stark reminder that the threat landscape is constantly evolving, with sophisticated actors actively seeking and exploiting vulnerabilities in widely used technologies. Remaining vigilant, prioritizing timely updates, and implementing a multi-layered security strategy are indispensable for protecting digital assets and maintaining operational integrity in the face of persistent cyber threats.

Key Takeaways

• CISA has added critical vulnerabilities in Microsoft SharePoint, MikroTik RouterOS, and Elementor WordPress to its Known Exploited Vulnerabilities (KEV) catalog, signifying active exploitation.
• The SharePoint vulnerability (CVE-2026-65660) is a code injection flaw with a CVSS score of 8.8, leading to potential remote code execution.
• Elementor WordPress plugin has a high-severity CSRF vulnerability (CVSS 8.8) that allows unauthenticated attackers to create rogue administrator accounts.
• MikroTik RouterOS flaws are also actively exploited, posing significant risks to network infrastructure.
• Immediate patching and regular updates for all affected systems are paramount to mitigate these active threats.
• Organizations must adopt a proactive cybersecurity posture, including strong authentication (MFA), network segmentation, regular security audits, and comprehensive employee training.

Sources

1. [1] Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link (feeds.feedburner.com)
2. [2] SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild (feeds.feedburner.com)
3. [3] Elementor WordPress flaw lets attackers create admin accounts (www.bleepingcomputer.com)
4. [4] CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks (www.bleepingcomputer.com)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.