What’s Vulnerable › Vulnerabilities

CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-09-25
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-05 · updated 2026-09-26
• Weakness: CWE-841

Description

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Affected products

• MikroTik RouterOS: from 6.0 before 6.49.21; from 7.0 before 7.23.4; from 7.24 before 7.24.2 — fixed in 6.49.21, 7.23.4, 7.24.2

How to fix

Upgrade to a fixed version: MikroTik RouterOS 6.49.21, 7.23.4, 7.24.2. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
• https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
• https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
• https://mikrotik.com/supportsec/september-2026-vulnerability/
• https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
• https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279

Get alerted when CVE-2026-67279 or the next vulnerability affects your stack