What’s Vulnerable › Vulnerabilities

CVE-2026-67276: SSH user impersonation possible in Mikrotik RouterOS

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-05 · updated 2026-09-25
• Weakness: CWE-347

Description

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

Affected products

• MikroTik RouterOS: from 7.9 before 7.23.4; from 7.24 before 7.24.2 — fixed in 7.23.4, 7.24.2

How to fix

Upgrade to a fixed version: MikroTik RouterOS 7.23.4, 7.24.2. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
• https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
• https://mikrotik.com/supportsec/september-2026-vulnerability/
• https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Get alerted when CVE-2026-67276 or the next vulnerability affects your stack