CVE-2026-67279: MikroTik RouterOS SSH Auth Bypass (KEV)

CVE-2026-67279 is a flaw in RouterOS's SSH server that lets an unauthenticated client trigger the post-rekey connection protocol without ever completing user authentication, open a session channel and send an exec request that RouterOS executes, enabling unauthenticated creation, overwrite and reconstruction of files in the managed file namespace — and CISA's catalog notes it can be chained with CVE-2026-86060 for full unauthenticated exploitation.

CVE-2026-67279 is an improper enforcement of behavioral workflow (CWE-841) in the SSH daemon of MikroTik RouterOS. NVD's description states that "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request," and that "on affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data" (NVD).

NVD lists the CVE as "Analyzed" with its own primary CVSS v3.1 base score of 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N — network-reachable, low attack complexity, no privileges or user interaction required, with low confidentiality and integrity impact (NVD).

CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-25, with a required-action due date of 2026-09-28, and its catalog entry states the flaw "can be chained to achieve unauthenticated exploitation of CVE-2026-86060" (CISA KEV).

MikroTik's own security advisory confirms the issue is "fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)" and recommends upgrading affected routers to one of these builds (MikroTik Vendor Advisory).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0103 (63.3th percentile) (FIRST EPSS).

Because the vulnerability is reachable from any network that can open an SSH session to the router, and is already catalogued as exploited and chainable with a second flaw, operators should upgrade affected RouterOS builds to 6.49.21, 7.23.4 or 7.24.2 and restrict SSH management access to trusted networks in the meantime.

• An unauthenticated SSH client can trigger the post-rekey connection protocol and send an exec request that RouterOS executes, enabling unauthenticated file creation/overwrite in the managed file namespace. — NVD
• CVSS v3.1 base score is 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, assigned directly by NVD (status: Analyzed). — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-25, due date 2026-09-28, chainable with CVE-2026-86060 for unauthenticated exploitation. — CISA KEV
• Affects RouterOS 6.0-6.49.20, 7.0-7.23.3 and 7.24-7.24.1; fixed in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). — MikroTik Vendor Advisory
• EPSS score is 0.0103 (63.3th percentile) as of 2026-10-21. — FIRST EPSS