--- id: "CVE-2026-67279" kind: "vulnerability" aliases: ["CVE-2026-67279"] title: "mikrotik routeros: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never\u2026" severity: "high" cvss: 6.9 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "MikroTik RouterOS", "fixed": ["6.49.21", "7.23.4", "7.24.2"], "affected": ">= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24, < 7.24.2", "ecosystem": "vendor"}, {"name": "mikrotik routeros", "fixed": ["6.49.21"], "affected": ">= 6.0, < 6.49.21", "ecosystem": "vendor"}, {"name": "mikrotik routeros", "fixed": ["7.23.4"], "affected": ">= 7.0, < 7.23.4", "ecosystem": "vendor"}, {"name": "mikrotik routeros", "fixed": ["7.24.2"], "affected": ">= 7.24, < 7.24.2", "ecosystem": "vendor"}, {"name": "MikroTik RouterOS", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "mikrotik", "network-edge", "routeros", "self-hosted", "ssh"] not_affected_if: ["patched-6.49.21+", "patched-version", "ssh-not-reachable"] published_at: "2026-09-05T20:17:18+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:24:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:43:15+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67279", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # mikrotik routeros: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never… RouterOS SSH server mishandles a rekey during user authentication and jumps to channel handling without authentication, so an unauthenticated client can open a session and send exec requests. Chained with CVE-2026-86060 (username '-2' lets the attacker set the login policy mask) this gives full admin access (MikroTrick). Exploited since 2 Sep 2026 from 82.192.72.4, which creates an 'ops' full-privilege account. CERT.pl did not publish a PoC; it gave one to the vendor. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:MikroTik RouterOS affected >= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24, < 7.24.2 fixed 6.49.21, 7.23.4, 7.24.2 - vendor:mikrotik routeros affected >= 6.0, < 6.49.21 fixed 6.49.21 - vendor:mikrotik routeros affected >= 7.0, < 7.23.4 fixed 7.23.4 - vendor:mikrotik routeros affected >= 7.24, < 7.24.2 fixed 7.24.2 - vendor:MikroTik RouterOS affected ? fixed ? ## How to check Run /system resource print for the RouterOS version (vulnerable: 6.x < 6.49.21, 7.0–7.23.3, 7.24.0–7.24.1); /ip service print and /ip firewall filter print show whether SSH (22) is reachable from untrusted networks. Compromise check: search /log print for 'login failure for user -2 from 82.192.72.4 via ssh' and 'user ops added by ssh', look for an unknown full-group 'ops' user (/user print), unknown scripts, a RIF diagnostic file fetched to 82.192.72.4, and a 'Flagged' critical log entry on patched devices. Logs predate patch: exploitation seen from 2 Sep 2026. Key-only SSH or strong-crypto does not protect. ## Fix Upgrade to 6.49.21, 7.23.4 or 7.24.2 or later. For the incomplete cert/host-key fix (CVE-2026-67278, RouterOS 7) use 7.24.3 or 7.23.6. Until patched: block SSH and WebFig from untrusted networks (default config already does), restrict to trusted IPs or reach the router only via WireGuard VPN. After upgrading, remove unknown users/scripts and follow MikroTik's Flagged-status instructions. No other workaround is documented by CERT.pl. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279 - 2026-10-23T20:24:38+00:00 analyst — MikroTik's advisory and the CVE record confirm an SSH-only flaw: unauthenticated exec after a client-requested rekey. Fixed in 6.49.21, 7.23.4 and 7.24.2. MikroTik says this is the issue exploited in the wild, and CERT Polska documents the chain with CVE-2026-86060 (MikroTrick). I found no public PoC link. - 2026-10-23T22:43:15+00:00 analyst — Read MikroTik advisory (updated 2026-10-06) and CERT.pl analysis: fixes 6.49.21/7.23.4/7.24.2; no remote-exec-free workaround beyond restricting SSH; IoCs and check steps added. No PoC published. X had only 2 posts in 7d, none saved. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67279 ## Documents - [advisory] MikroTik: September 2026 vulnerability https://mikrotik.com/supportsec/september-2026-vulnerability/ - [advisory] CVE Record CVE-2026-67279 https://www.cve.org/CVERecord?id=CVE-2026-67279 - [describes] CERT Polska: MikroTrick technical analysis https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/ - [mentions] CERT.pl: MikroTrick, RouterOS vulnerabilities actively exploited https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ ## From the sources Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_