CVE-2026-67279 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-05

Added to CISA KEV: 2026-09-25 20 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
PATCH IMMEDIATELY: Upgrade RouterOS to 6.49.21 (Long-term branch), 7.23.4 (Long-term branch), or 7.24.2 (Stable branch) — all three branches have fixes available now.
FIREWALL SSH ACCESS: If immediate patching is not possible, restrict SSH (TCP/22) access to trusted management IP addresses only using RouterOS firewall rules (ip firewall filter) or upstream ACLs. This is the highest-priority interim mitigation.
AUDIT EXPOSURE: Use Shodan, your own asset inventory, or MikroTik's The Dude/Winbox to identify all internet-facing RouterOS devices in your environment with SSH enabled.
REVIEW FILE INTEGRITY: Check RouterOS file storage (/file print) for unexpected files, particularly any modifications to configuration exports, backup files, or support files that may indicate prior exploitation.
REVIEW SSH LOGS: Examine SSH login attempts and session logs for anomalous pre-authentication traffic patterns, unexpected rekey sequences, or short-lived unauthenticated sessions.
DISABLE SSH IF UNUSED: If SSH is not actively used for management, disable it and use Winbox or the web interface over a restricted management VLAN instead.
ENABLE LOGGING: Ensure logging of all SSH connection attempts is enabled and forwarded to a SIEM for anomaly detection.
CONSIDER NETWORK SEGMENTATION: Place RouterOS management interfaces on a dedicated out-of-band management VLAN not reachable from the internet.
PATCH PRIORITY: CRITICAL — No authentication required, public PoC exists, automatable, massive internet-facing attack surface. Treat as P0/emergency patch.

🔍 Web Intelligence (Kagi · 2026-09-25)

Summary

CVE-2026-67279 is an authentication bypass vulnerability affecting the Secure Shell (SSH) implementation within MikroTik RouterOS. The flaw occurs because the SSH service enters the connection protocol after a client-requested rekey, even if the user has not yet been authenticated. This critical oversight allows an unauthenticated, remote attacker to open a session channel and send arbitrary `exec` requests, potentially leading to unauthorized system modifications.

Exploitation

Active exploitation: There are currently no reports of active exploitation in the wild.
Threat actors/Ransomware: No specific threat actors or ransomware campaigns have been linked to this vulnerability.
Proof-of-Concept/Exploit: No public proof-of-concept (PoC) code or functional exploit tools are currently available.
Attack prerequisites:

- Network access: Required; the attack can be launched remotely over the network. - Authentication: None required; the vulnerability allows an attacker to bypass the authentication process entirely. - User interaction: None required.

Affected Products & Patches

Affected versions: While specific affected version ranges are awaiting final NVD enrichment, the vulnerability impacts MikroTik RouterOS systems utilizing the affected SSH implementation.
Patch/Hotfix: Users should check MikroTik’s official security advisories for the latest software releases and security patches.
Mitigations: Organizations are advised to update their RouterOS devices to the latest available version provided by the vendor. Restricting access to SSH services to trusted IP addresses via firewalls is a recommended temporary workaround to limit exposure.

Impact

Access/Capability: Successful exploitation grants an unauthenticated attacker the ability to open a session channel and execute commands on the device, which may result in file system modifications or other unauthorized administrative actions.
Business Risk: For internet-facing deployments, this vulnerability poses a significant risk, as it permits remote, unauthenticated command execution, potentially leading to full device compromise, data manipulation, or the usage of the router as a pivot point for further network attacks.