{"id":"CVE-2026-67279","kind":"vulnerability","aliases":["CVE-2026-67279"],"related":[],"title":"mikrotik routeros: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never…","description":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"RouterOS SSH server mishandles a rekey during user authentication and jumps to channel handling without authentication, so an unauthenticated client can open a session and send exec requests. Chained with CVE-2026-86060 (username '-2' lets the attacker set the login policy mask) this gives full admin access (MikroTrick). Exploited since 2 Sep 2026 from 82.192.72.4, which creates an 'ops' full-privilege account. CERT.pl did not publish a PoC; it gave one to the vendor.","severity":"high","cvss":6.9,"epss":null,"exploited":true,"exploited_at":"2026-09-25T00:00:00+00:00","products":[{"name":"MikroTik RouterOS","fixed":["6.49.21","7.23.4","7.24.2"],"affected":">= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24, < 7.24.2","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["6.49.21"],"affected":">= 6.0, < 6.49.21","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["7.23.4"],"affected":">= 7.0, < 7.23.4","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["7.24.2"],"affected":">= 7.24, < 7.24.2","ecosystem":"vendor"},{"name":"MikroTik RouterOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","mikrotik","network-edge","routeros","self-hosted","ssh"],"not_affected_if":["patched-6.49.21+","patched-version","ssh-not-reachable"],"how_to_check":"Run /system resource print for the RouterOS version (vulnerable: 6.x < 6.49.21, 7.0–7.23.3, 7.24.0–7.24.1); /ip service print and /ip firewall filter print show whether SSH (22) is reachable from untrusted networks. Compromise check: search /log print for 'login failure for user -2 from 82.192.72.4 via ssh' and 'user ops added by ssh', look for an unknown full-group 'ops' user (/user print), unknown scripts, a RIF diagnostic file fetched to 82.192.72.4, and a 'Flagged' critical log entry on patched devices. Logs predate patch: exploitation seen from 2 Sep 2026. Key-only SSH or strong-crypto does not protect.","fix":"Upgrade to 6.49.21, 7.23.4 or 7.24.2 or later. For the incomplete cert/host-key fix (CVE-2026-67278, RouterOS 7) use 7.24.3 or 7.23.6. Until patched: block SSH and WebFig from untrusted networks (default config already does), restrict to trusted IPs or reach the router only via WireGuard VPN. After upgrading, remove unknown users/scripts and follow MikroTik's Flagged-status instructions. No other workaround is documented by CERT.pl.","status":"open","published_at":"2026-09-05T20:17:18+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T22:41:29+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:41:29Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade RouterOS to 6.49.21, 7.23.4, or 7.24.2 or later, depending on your release branch.\nFollow vendor instructions and CISA BOD 26-04 guidance for mitigations if upgrade is not possible.","reach":"internet","title":"MikroTik RouterOS: unauthenticated SSH session can send exec requests","impact":"high","summary":"RouterOS improperly enforces its workflow, letting an unauthenticated client open a session channel and send an exec request. The flaw can be chained with CVE-2026-86060 to reach unauthenticated exploitation, and CISA lists it as exploited in the wild.","category":"infrastructure","nicknames":["MikroTrick"],"who_cares":["mikrotik","routeros","self-hosted","ssh"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated attacker gets exec access on the router","analyst_note":"Confirm how_to_check (exposed SSH service and RouterOS version) and whether a remote-exec-free mitigation exists in the CERT Polska analysis and MikroTik advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000582,"input_tokens":3491,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm how_to_check (exposed SSH service and RouterOS version) and whether a remote-exec-free mitigation exists in the CERT Polska analysis and MikroTik advisory.","search":"'-04':181C,207C,238C '-2':83B '-2026':22A,25A,80B,162C '-67279':23A,26A '-86060':81B,163C '2':100B '2026':102B '26':180C,206C,237C '82.192.72.4':104B 'access':96B 'accord':170C 'account':112B 'achiev':157C 'action':166C 'adher':234C 'admin':95B 'allow':137C 'appli':167C 'applic':204C 'asset':228C 'attack':86B 'authent':18A,57B,64B 'base':185C 'behavior':132C 'bod':179C,205C,236C 'cert.pl':113B 'chain':77B,155C 'channel':61B,145C 'cisa':164C,177C,194C 'client':12A,68B,140C 'client-request':11A 'cloud':210C 'complianc':175C 'connect':7A 'contain':127C 'could':136C 'creat':106B 'cve':21A,24A,79B,161C 'discontinu':213C 'edg':43B 'enforc':130C 'ensur':174C,233C 'enter':5A 'evalu':226C 'even':15A 'exec':75B,149C 'exploit':38B,98B,159C 'exposur':231C 'follow':203C 'forens':196C 'full':94B,110B 'full-privileg':109B 'gave':120B 'give':93B 'guidanc':192C,208C 'guidelin':240C 'handl':62B 'host':47B 'improp':129C 'infrastructur':39B 'instruct':173C 'internet':230C 'jump':59B 'let':84B 'login':89B 'mask':91B 'mikrotik':1A,28A,30A,32A,34A,36A,40B,125C 'mikrotrick':27A,97B 'mishandl':52B 'mitig':168C,219C 'network':42B 'network-edg':41B 'never':20A 'note':191C,202C 'one':121B 'op':108B 'open':70B,142C 'patch':239C 'poc':118B 'polici':90B 'priorit':182C 'privileg':111B 'product':217C 'protocol':8A 'publish':116B 'rekey':14A,54B 'request':13A,76B,150C 'requir':165C,198C 'respons':224C 'risk':187C 'routero':2A,3A,44B,49B,126C 'routeros':29A,31A,33A,35A,37A 'secur':183C 'see':188C,199C 'self':46B 'self-host':45B 'send':74B,147C 'sep':101B 'server':51B 'servic':211C 'session':72B,144C 'set':87B 'sinc':99B 'ssh':4A,48B,50B 'stakehold':222C 'though':16A 'triag':197C 'unauthent':67B,139C,158C 'unavail':221C 'updat':184C 'url':189C,200C 'use':214C 'user':17A,56B 'usernam':82B 'vendor':124B,172C 'vulner':134C,152C 'without':63B 'workflow':133C","nicknames":["MikroTrick"],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-05T20:17:18+00:00","kev":{"dateAdded":"2026-09-25","dueDate":"2026-09-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-67279","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279","severity":null,"published_at":"2026-09-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-67279:12","url":null,"severity":null,"published_at":"2026-10-23T20:24:38+00:00","modified_at":"2026-10-23T20:24:38+00:00","first_seen_at":"2026-10-23T20:24:38+00:00","fetched_at":"2026-10-23T20:24:38+00:00","note":"MikroTik's advisory and the CVE record confirm an SSH-only flaw: unauthenticated exec after a client-requested rekey. Fixed in 6.49.21, 7.23.4 and 7.24.2. MikroTik says this is the issue exploited in the wild, and CERT Polska documents the chain with CVE-2026-86060 (MikroTrick). I found no public PoC link."},{"source":"analyst","external_id":"CVE-2026-67279:284","url":null,"severity":null,"published_at":"2026-10-23T22:43:15+00:00","modified_at":"2026-10-23T22:43:15+00:00","first_seen_at":"2026-10-23T22:43:15+00:00","fetched_at":"2026-10-23T22:43:15+00:00","note":"Read MikroTik advisory (updated 2026-10-06) and CERT.pl analysis: fixes 6.49.21/7.23.4/7.24.2; no remote-exec-free workaround beyond restricting SSH; IoCs and check steps added. No PoC published. X had only 2 posts in 7d, none saved."},{"source":"nvd","external_id":"CVE-2026-67279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67279","severity":null,"published_at":"2026-09-05T20:17:18+00:00","modified_at":"2026-09-26T04:17:47+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":827,"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","title":"MikroTik: September 2026 vulnerability","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":828,"url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","title":"CERT Polska: MikroTrick technical analysis","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":829,"url":"https://www.cve.org/CVERecord?id=CVE-2026-67279","title":"CVE Record CVE-2026-67279","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1166,"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","title":"CERT.pl: MikroTrick, RouterOS vulnerabilities actively exploited","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}