CISA has added CVE-2026-67279 to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is in MikroTik RouterOS SSH. It lets an unauthenticated client open a session channel and run an exec request.
What Is It
CVE-2026-67279 is an improper enforcement of behavioral workflow vulnerability (CWE-841) in the RouterOS SSH service. According to NVD, if a client requests a rekey, RouterOS SSH moves into the connection protocol even though the client never attempted user authentication. The unauthenticated client can then open a session channel and send an exec request. On affected builds the server runs that command. An attacker can use this to create, overwrite and reconstruct files in the RouterOS managed file namespace without authenticating. That includes support files containing configuration and diagnostic data.
CISA notes that this vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Why It Matters
CISA added CVE-2026-67279 to the KEV catalog on 2026-09-25, which confirms active exploitation. CISA's SSVC assessment also records exploitation as "active", automatable as "yes" and technical impact as "partial". Whether ransomware campaigns have used it is listed as "Unknown".
NVD scores the flaw 6.5 (MEDIUM) under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). CERT Polska rates it 6.9 (MEDIUM) under CVSS 4.0. Attacks come over the network, need no privileges or user interaction and have low complexity.
What's Vulnerable
MikroTik RouterOS in these version ranges:
- 6.0.0 up to (but not including) 6.49.21
- 7.0.0 up to (but not including) 7.23.4
- 7.24 up to (but not including) 7.24.2
Patch Status
MikroTik has fixed the issue in:
- 6.49.21 (Long-term)
- 7.23.4 (Long-term)
- 7.24.2 (Stable)
CISA's required action is to apply mitigations according to vendor instructions and to follow BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements guidance. If mitigations are unavailable, organizations should follow the applicable BOD 26-04 guidance for cloud services or stop using the product. Stakeholders must evaluate each asset's internet exposure. The federal remediation due date is 2026-09-28.
Sources
- MikroTik Vendor Advisory (September 2026)
- CISA KEV Catalog – CVE-2026-67279
- NVD – CVE-2026-67279
- CERT Polska – MikroTik RouterOS CVE
- CERT Polska – Vulnerabilities in MikroTik RouterOS Actively Exploited
- MikroTik Forum – 6.49.21 Long-term Release
- MikroTik Forum – 7.23.4 Long-term Release
- MikroTik Forum – 7.24.2 Stable Release
- Bishop Fox – MikroTrick: Inside the RouterOS Takeover Chain
- npratley.net – Reversing MikroTik's Silent Patch
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements)