Vulnerability in RouterOS SSH Allows Unauthorized Command Execution
CVE-2026-67279
Key Information:
Badges
What is CVE-2026-67279?
CVE-2026-67279 is a vulnerability found in RouterOS, the operating system developed by MikroTik for their routers and network devices. This vulnerability occurs within the SSH protocol, where the system improperly accepts a connection from an unauthenticated client after a rekey request. As a result, attackers can create an active session without proper authentication, allowing them to send and execute commands on the affected device. This could lead to unauthorized activities such as the creation, modification, or deletion of files within the RouterOS file system, potentially compromising the device's configuration and sensitive operational data.
The implications of this vulnerability are significant, especially for organizations that rely on RouterOS for network management. By allowing unrestricted command execution, it opens the door for potential exploitation by malicious actors, who could manipulate network settings, disrupt operations, or facilitate further attacks on interconnected systems.
Potential Impact of CVE-2026-67279
-
Unauthorized Access and Control: Attackers can gain control over RouterOS devices without authentication, enabling them to perform commands that could compromise network integrity.
-
Configuration Manipulation: The ability to modify or delete critical configuration files could lead to network misconfigurations, service outages, or the introduction of security vulnerabilities that could be exploited for further attacks.
-
Data Exposure: Sensitive information stored within the RouterOS managed file namespace, such as configurations and diagnostic data, could be accessed or altered, leading to a potential breach of confidential organizational data and a loss of trust.
CISA has reported CVE-2026-67279
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-67279 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Version(s)
RouterOS 7.24 < 7.24.2
RouterOS 7.0.0 < 7.23.4
RouterOS 6.0.0 < 6.49.21
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
The Hacker NewsSharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA adds exploited SharePoint RCE and RouterOS flaws to KEV; the RouterOS chain can give unauthenticated administrative access.
5 hours ago
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
Attackers chained two RouterOS SSH flaws to gain full admin access on Internet-exposed MikroTik routers before patches shipped.
3 days ago
Esecurity PlanetMikroTik RouterOS Vulnerabilities Actively Exploited via SSH | eSecurity Planet
Attackers are actively exploiting MikroTik RouterOS flaws for unauthenticated router takeover. Here are the fixes, indicators of compromise, and post-patch checks. Attackers are exploiting MikroTik RouterOS SSH flaws for full router takeover. See fixed versions, attack indicators, and post-update ch...
3 weeks ago
References
CVSS V4
Timeline
- 🦅
CISA Reported
- 📰
First article discovered by Esecurity Planet
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved