CVE-2026-67279 is a flaw in RouterOS's SSH server that lets an unauthenticated client trigger the post-rekey connection protocol without ever completing user authentication, open a session channel and send an exec request that RouterOS executes, enabling unauthenticated creation, overwrite and reconstruction of files in the managed file namespace — and CISA's catalog notes it can be chained with CVE-2026-86060 for full unauthenticated exploitation.
Vulnerability summary
CVSS base score
6.5
Medium severity
EPSS score (FIRST)
1.0%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-67279 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| MikroTik RouterOS | cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* | 6.0 through 6.49.20 (fixed in 6.49.21 Long-term); 7.0 through 7.23.3 (fixed in 7.23.4 Long-term); 7.24 through 7.24.1 (fixed in 7.24.2 Stable) |
What does this mean for affected devices?
CVE-2026-67279 is an improper enforcement of behavioral workflow (CWE-841) in the SSH daemon of MikroTik RouterOS. NVD's description states that "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request," and that "on affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data" (NVD).
NVD lists the CVE as "Analyzed" with its own primary CVSS v3.1 base score of 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N — network-reachable, low attack complexity, no privileges or user interaction required, with low confidentiality and integrity impact (NVD).
CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-25, with a required-action due date of 2026-09-28, and its catalog entry states the flaw "can be chained to achieve unauthenticated exploitation of CVE-2026-86060" (CISA KEV).
MikroTik's own security advisory confirms the issue is "fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)" and recommends upgrading affected routers to one of these builds (MikroTik Vendor Advisory).
As of 2026-10-21, FIRST scores the probability of exploitation at 0.0103 (63.3th percentile) (FIRST EPSS).
Because the vulnerability is reachable from any network that can open an SSH session to the router, and is already catalogued as exploited and chainable with a second flaw, operators should upgrade affected RouterOS builds to 6.49.21, 7.23.4 or 7.24.2 and restrict SSH management access to trusted networks in the meantime.
Evidence
- An unauthenticated SSH client can trigger the post-rekey connection protocol and send an exec request that RouterOS executes, enabling unauthenticated file creation/overwrite in the managed file namespace. — NVD
- CVSS v3.1 base score is 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, assigned directly by NVD (status: Analyzed). — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-25, due date 2026-09-28, chainable with CVE-2026-86060 for unauthenticated exploitation. — CISA KEV
- Affects RouterOS 6.0-6.49.20, 7.0-7.23.3 and 7.24-7.24.1; fixed in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). — MikroTik Vendor Advisory
- EPSS score is 0.0103 (63.3th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
How does an attacker bypass SSH authentication in affected RouterOS builds?
RouterOS's SSH server enters the connection protocol after a client-requested rekey even though user authentication was never attempted, letting an unauthenticated client open a session channel and send an exec request that the server dispatches (per NVD).
What can an attacker actually do once they have bypassed authentication this way?
The flaw enables unauthenticated creation, overwrite and reconstruction of files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data (per NVD).
Why is this CVE rated only medium (6.5) if it is an authentication bypass?
NVD's CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) gives it only low confidentiality and low integrity impact and no availability impact, reflecting that the primary consequence NVD scored is unauthorized file manipulation within the managed namespace rather than full device compromise (per NVD).
Is CVE-2026-67279 being exploited, and can it be combined with other vulnerabilities?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-25 with a required-action due date of 2026-09-28, and its catalog entry states the flaw "can be chained to achieve unauthenticated exploitation of CVE-2026-86060" (per CISA KEV).
Questions about this page?