CERT Polska details six MikroTik RouterOS CVEs
CERT Polska disclosed six RouterOS vulnerabilities enabling SSH auth bypass, unauthenticated RCE-like file writes, TLS impersonation, remote crash, and privilege escalation; patches available.
Sourcecert.pl — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-67277, CVE-2026-67279, and CVE-2026-86060 as exploited in the wild.
CERT Polska coordinated disclosure of six vulnerabilities in MikroTik RouterOS affecting SSH authentication, WebFig, X.509 validation, and the bandwidth-test service. The most severe issues include CVE-2026-67276, an SSH public-key authentication bypass caused by incomplete RSA key comparison (exponent not checked), allowing an attacker who knows an authorized RSA modulus to forge a valid signature and open an SSH session as the target user without possessing the private key. CVE-2026-67279 allows unauthenticated attackers to reach the SSH connection protocol via a rekey request without completing authentication, enabling exec requests that can create, overwrite, or reconstruct files in RouterOS's managed file namespace, including configuration and diagnostic support files. CVE-2026-67281 is an unauthenticated file-read vulnerability in WebFig's /jsproxy path, exploitable via a stale uninitialized pointer and directory traversal in an encrypted URI, disclosing root-owned files including credential stores.
Additional issues include CVE-2026-67278, a flaw in RouterOS's X.509 trust validation stemming from an e=3 root CA in the trust store and acceptance of malformed PKCS#1 v1.5 signatures, allowing an attacker who can intercept outbound TLS connections to forge a trusted intermediate certificate and impersonate arbitrary TLS servers without the root's private key. CVE-2026-67277 is an unauthenticated denial-of-service in the btest UDP service, where a related connection is accepted before primary session authentication completes, leading to leakage of uninitialized kernel memory and an integer underflow that can crash and restart the RouterOS kernel. CVE-2026-86060 is a privilege escalation via an SSH login argument-handling flaw involving prohibited leading characters in usernames, which can alter the trusted RouterOS policy mask, though it requires an unauthenticated SSH session reaching the login helper.
All six vulnerabilities were fixed in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). Given the chainable nature of these flaws — authentication bypass, file disclosure/write, TLS impersonation, and privilege escalation — RouterOS administrators should prioritize patching, especially on devices with SSH, WebFig, or bandwidth-test services exposed to untrusted networks.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs