The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added two significant vulnerabilities to its Known Exploited Vulnerabilities catalogue, both with evidence of active in-the-wild exploitation. For hosting operators, infrastructure managers, and anyone running multi-tenant or internally-networked systems, the implications warrant immediate attention.
The Vulnerabilities in Play
Microsoft SharePoint has long been a common target for attackers seeking persistent access to corporate networks. The latest SharePoint code injection flaw carries a CVSS score of 8.8, indicating high severity. Code injection vulnerabilities in SharePoint are particularly troublesome because SharePoint instances frequently sit within trusted network boundaries, handle sensitive documents, and maintain authentication tokens that can pivot to downstream systems.
The MikroTik RouterOS issue compounds the problem. Router firmware flaws are infrastructure-level concerns; compromise at this layer can sniff traffic, redirect flows, or enable lateral movement across an entire network segment. For hosting facilities relying on MikroTik equipment for network edge routing, load balancing, or customer isolation, an unpatched flaw becomes a systemic risk.
Why This Matters for Hosting and Infrastructure Teams
Active exploitation means attackers have working proof-of-concept code and are actively using it. This is not a theoretical risk or a future threat. Threat actors targeting hosting environments often begin with reconnaissance of the management layer — which includes SharePoint for administrative documentation and routers for network topology insight. Once either is compromised, lateral movement to customer infrastructure or other hosted systems becomes feasible.
Hosting facilities and operators running dedicated servers, VPS, or colocation services must recognise that router and internal management system security directly affects the security posture of every customer on that network. A compromised router can enable traffic inspection, SSL stripping, or selective packet manipulation that customers cannot detect from their own systems.
Immediate Actions for Operators
First, inventory your infrastructure. Identify all systems running affected Microsoft SharePoint versions and all MikroTik RouterOS instances, particularly those handling network edge or customer traffic isolation. Document which systems face the internet and which are internal-only; prioritise internet-exposed instances.
For SharePoint, Microsoft will issue patches; the key is timing. Schedule maintenance windows to deploy updates before attackers can weaponise the flaw more widely. For MikroTik, check the vendor advisories and firmware release notes immediately. RouterOS updates often require device reboot; plan accordingly to minimise customer impact.
Second, implement network segmentation. Ensure that management systems — including SharePoint and routers — are isolated from customer-facing infrastructure. Use separate VLAN assignments, firewall rules, and access control lists to prevent lateral movement. If a router or SharePoint instance is compromised, it should not grant an attacker direct access to customer virtual machines or dedicated servers.
Third, enable comprehensive logging on both systems. Many attacks proceed silently; detection depends on audit trails. Log all code execution events on SharePoint and all administrative actions on routers. Forward logs to a centralised SIEM or aggregation point separate from the systems themselves.
Broader Lessons
These vulnerabilities illustrate a recurring pattern: infrastructure components — routers, content management systems, administrative dashboards — are often treated as less critical than application servers, yet they occupy positions of extreme trust. A compromise at the infrastructure layer can compromise many customers simultaneously, whereas a flaw in a single customer's web application affects only that customer.
Hosting operators and infrastructure teams should adopt a principle of constant vigilance toward management and network systems. Patch cycles for these components should be as rigorous as for customer-facing services. Where possible, adopt zero-trust principles: even internal systems should authenticate requests and enforce least-privilege access.
Active exploitation in the wild is a clock. Apply patches, verify configurations, and review logs sooner rather than later.
