DAILY BRIEFING
CISA Adds SharePoint and MikroTik Flaws to KEV; Kiteworks Urges Shutdown
Today's briefing covers active exploitation of SharePoint and MikroTik vulnerabilities, Kiteworks precautionary shutdown advisories, and a federal sentencing in the Snowflake extortion cases.
5 stories2 min read
Federal security advisories and critical software warnings highlight today's landscape as threat actors actively target enterprise infrastructure and networking platforms. Security personnel face immediate operational demands across content management tools, collaboration servers, and edge devices.
System administrators should prioritize remediation of vulnerabilities added to active exploitation catalogs and review precautionary shutdown advisories. The ongoing threats underscore the necessity of strict privilege controls and aggressive patch management.
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA added SharePoint code injection flaw CVE-2026-65660 and MikroTik RouterOS workflow enforcement flaw CVE-2026-67279 to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild.
- Why it matters
- Attackers are actively exploiting these bugs to achieve remote code execution on SharePoint servers and open unauthorized sessions on MikroTik routers.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
A cross-site request forgery (CSRF) vulnerability with a CVSS score of 8.8 affects Elementor Website Builder versions 4.3.0 and 4.3.1. An unauthenticated attacker can create a rogue administrator account if an authenticated admin clicks a crafted link.
- Why it matters
- Over 2 million WordPress sites running the affected Elementor versions are exposed to complete site takeover via administrator account creation.
- What to do
- Update Elementor Website Builder plugin instances to a version beyond 4.3.1 immediately.
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Kiteworks recommended that customers shut down systems for a nine-hour window following federal threat intelligence warnings regarding an imminent targeted attack, though no compromise has been detected.
- Why it matters
- Organizations relying on Kiteworks face operational disruption during the precautionary shutdown but reduce exposure to an impending threat.
- What to do
- Follow Kiteworks security advisories and evaluate system access logs for suspicious activity.
OpenAI's AI agents accidentally uploaded user-provided images to third-party sites
OpenAI says its AI agents uploaded user-provided images to third-party image-hosting services while carrying out research and evaluation tasks.
- Why it matters
- Users uploading sensitive or proprietary images to AI agent interfaces could face unauthorized exposure or third-party data leakage.
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
U.S. Army soldier Cameron John Wagenius was sentenced to 70 months in prison for using compromised Snowflake credentials without MFA to steal call and text metadata from AT&T and extort telecommunications firms.
- What to do
- Enforce multi-factor authentication across all cloud storage accounts and centralized data platforms.
Key takeaways
- CISA added SharePoint code injection (CVE-2026-65660) and MikroTik RouterOS flaw (CVE-2026-67279) to its Known Exploited Vulnerabilities catalog.
- Kiteworks advised customers to perform a precautionary 9-hour server shutdown following federal threat intelligence regarding an imminent attack.
- A CSRF vulnerability in Elementor versions 4.3.0 and 4.3.1 affecting 2 million sites allows attackers to create rogue administrator accounts.
- U.S. soldier Cameron John Wagenius was sentenced to 70 months in prison and $294,978 in restitution for extorting AT&T and Verizon.