MikroTik RouterOS SSH flaws exploited in wild
Attackers are chaining three MikroTik RouterOS vulnerabilities to gain full control of routers with internet-exposed SSH; patches available.
NCSC-NL published an advisory detailing three vulnerabilities in MikroTik RouterOS that CERT Polen has observed being actively exploited in combination against routers with SSH services exposed to the internet. The first flaw (CVE-2026-67276) stems from improper verification of RSA signature exponents in the SSH authentication mechanism, allowing attackers to forge RSA signatures and obtain unauthorized SSH access. The second (CVE-2026-86060) involves usernames beginning with a disallowed character that can manipulate the trusted policy mask, enabling privilege escalation during the SSH login process. The third (CVE-2026-67277) allows unauthenticated clients to trigger an IPv4 UDP test that, due to improper kernel packet handling, can cause kernel restarts and denial of service.
According to the advisory, in observed attacks multiple of these vulnerabilities were chained together to gain full control over affected routers. MikroTik has released fixed versions — RouterOS 6.49.21, 7.23.4 and 7.24.2 — addressing all three issues. NCSC-NL and MikroTik recommend not exposing SSH directly to the internet, instead restricting access via VPN and/or IP whitelisting as a mitigating control while patching is completed.
Defenders operating MikroTik RouterOS devices should prioritize patching to the fixed versions, audit for internet-facing SSH exposure, and review authentication logs for anomalous SSH logins or unexpected kernel restarts that could indicate exploitation attempts.
Mentioned in this report
Detection guidance
MikroTik RouterOS Unexpected Kernel Restart After UDP Test
Detects kernel restart events on MikroTik RouterOS following unauthenticated IPv4 UDP test packets, indicative of CVE-2026-67277 DoS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MikroTik RouterOS Unexpected Kernel Restart After UDP Test
description: Detects kernel restart events on MikroTik RouterOS following unauthenticated
IPv4 UDP test packets. CVE-2026-67277 allows unauthenticated clients to trigger
IPv4 UDP tests that cause kernel restarts due to improper packet handling.
tags:
- attack.impact
- attack.t1499
logsource:
product: mikrotik
service: kernel
detection:
selection:
EventType: kernel_restart
Reason: unexpected_restart
condition: selection
falsepositives:
- Legitimate kernel updates or scheduled maintenance
- Hardware failures causing spontaneous restarts
level: high
id: 009d6eb8-9fc1-5b9b-a995-f9ce716784fa
status: experimental
author: Vorant
SSH Login with Forged RSA Signature on MikroTik RouterOS
Detects SSH authentication attempts on MikroTik RouterOS using RSA signatures with anomalous exponent values, indicative of forged signatures exploiting CVE-2026-67276. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Login with Forged RSA Signature on MikroTik RouterOS
description: Detects SSH authentication success on MikroTik RouterOS where RSA signature
validation occurs despite improper exponent verification. CVE-2026-67276 allows
attackers to forge RSA signatures by bypassing exponent validation in the SSH authentication
mechanism.
tags:
- attack.initial-access
- attack.t1190
logsource:
product: mikrotik
service: ssh
detection:
selection:
EventType: auth_success
AuthMethod: rsa-key
RSAExponentValidation: failed
condition: selection
falsepositives:
- Misconfigured SSH keys with non-standard exponents (rare)
- Legacy systems with unusual RSA key parameters
level: high
id: a71b1474-f6d8-56f7-8017-0f3809f77557
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0345.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free