CVE-2026-67279

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-67279 6.5

MikroTik · RouterOS · Added 2026-09-25 · Published 2026-09-05

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

VendorMikroTik

ProductRouterOS

Date added2026-09-25

Due date2026-09-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-841

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Descriptions

KEV: Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

NVD: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-25 15:33 UTC

Wall time0.5s

Searches8

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-67279
https://mikrotik.com/supportsec/september-2026-vulnerability/
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
https://github.com/digiprosec/MicroTrick
https://github.com/runZeroInc/sshamble
https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Hunting hypothesis agent

Hunt RouterOS `/log` for the MikroTrick SSH chain: `login failure for user -2 from <ip> via ssh` then `user <name> added by ssh:-2@<ip>`, marking a pre-auth rekey that opens a session channel before authentication.

Research details

ComponentSSH server connection-protocol handler dispatching session-channel exec requests after a client-requested pre-auth key re-exchange (rekey before userauth)

PreconditionsUnauthenticated TCP reachability to the SSH service on a vulnerable version (6.0.0-6.49.20, 7.0.0-7.23.3, 7.24-7.24.1); no prior authentication is needed - a rejected userauth attempt must leave the username pending in session state before the client-requested rekey; SSH must be accessible from the attacker network (MikroTik's default firewall blocks it from the internet unless manually opened). agent

Public PoCyes

PoC URLs https://github.com/digiprosec/MicroTrick Third-party repos; verify before use.

Advisoryhttps://mikrotik.com/supportsec/september-2026-vulnerability/

Exploit notesA functional public chain PoC (github.com/digiprosec/MicroTrick, paramiko) uses the CVE-2026-67279 pre-auth rekey as step 2: rejected password auth for user '-2', rekey, unauthenticated session-channel open + PTY/shell, then the CVE-2026-86060 policy-mask frame; it refuses non-private targets. runZero SSHamble also ships detection-only tooling (check 'vuln-mikrotik-preauth-rekey') that probes whether a server honors a session channel after a pre-auth rekey - no weaponized code beyond the chain PoC. Stock RouterOS logs do not record the rekey or the pre-auth channel open, so catching the attempt itself needs an SSH-aware sensor or packet capture; the '-2' log lines appear only while the chain runs, and CERT Polska reports the chain actively exploited in the wild since at least 2026-09-02.

SummaryMikroTik RouterOS contains an improper enforcement of behavioral workflow flaw (CWE-841) in its SSH server: a key re-exchange requested before user authentication completes makes the server enter the connection protocol anyway, letting an unauthenticated client open a session channel and dispatch exec requests. On affected builds the command is dispatched, enabling unauthenticated creation, overwrite and reconstruction of files in the RouterOS managed file namespace, including support files holding configuration and diagnostic data. It is one of six flaws CERT Polska disclosed under the chain name MikroTrick, observed exploited in the wild against internet-exposed SSH and fixed in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).

Tia coverage

First reported2026-08-11

First exploit report2026-09-25

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-exploited-wso2-adobe-commerce-sharepoint-and-routeros trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.