CVE-2026-67279

CVE-2026-67279 is a medium-severity vulnerability in Mikrotik Routeros with a CVSS 3.x base score of 6.5. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2026-09-25). The underlying weakness is classified as CWE-841.

Key facts

• Severity: Medium (CVSS 3.x base score 6.5)
• CVSS v4: 6.9
• EPSS exploit prediction: 1% (62nd percentile)
• Actively exploited: Yes — listed in CISA KEV (added 2026-09-25)
• Weakness: CWE-841
• Affected product: Mikrotik Routeros
• Published: 2026-09-05
• Last modified: 2026-09-26

Description

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Frequently asked questions

What is CVE-2026-67279?

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

How severe is CVE-2026-67279?

CVE-2026-67279 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-67279 being actively exploited?

Yes. CVE-2026-67279 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-09-25, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2026-67279?

CVE-2026-67279 affects Mikrotik Routeros. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-67279?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

When was CVE-2026-67279 published?

CVE-2026-67279 was published on 2026-09-05 and last updated on 2026-09-26.

References

• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
• https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
• https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
• https://mikrotik.com/supportsec/september-2026-vulnerability/
• https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
• https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279

Affected products (1)

• cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*

More vulnerabilities in Mikrotik Routeros

• CVE-2026-86060 — Critical (CVSS 9.8): RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited…
• CVE-2017-20149 — Critical (CVSS 9.8): The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka…
• CVE-2022-34960 — Critical (CVSS 9.8): The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic…
• CVE-2018-7445 — Critical (CVSS 9.8): A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.…
• CVE-2026-67278 — Critical (CVSS 9.1): MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509…
• CVE-2023-30799 — Critical (CVSS 9.1): MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A…

All CVEs affecting Mikrotik Routeros →

Other CWE-841 vulnerabilities

• CVE-2026-3130 — Critical (CVSS 9.8): Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated…
• CVE-2025-48481 — Critical (CVSS 9.8): FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated…
• CVE-2022-2105 — Critical (CVSS 9.4): Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication,…
• CVE-2026-34582 — Critical (CVSS 9.1): Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData…
• CVE-2026-95369 — High (CVSS 8.8): Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially…
• CVE-2025-48476 — High (CVSS 8.8): FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user…

Browse all CWE-841 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

• 109.238.212.91 (ipv4-addr)
• 102.211.145.97 (ipv4-addr)
• 45.179.5.24 (ipv4-addr)
• 78.154.179.168 (ipv4-addr)