MikroTik RouterOS flaws let attackers hijack admins
Exploited-in-the-wild RouterOS bugs let attackers bypass SSH auth or escalate to full admin control without credentials.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-67277 and CVE-2026-86060 as exploited in the wild.
MS-ISAC has issued an advisory covering multiple vulnerabilities in MikroTik RouterOS that could allow unauthenticated attackers to hijack admin access. The most severe issue, CVE-2026-67276, is an SSH authentication bypass where RouterOS only compares the public modulus of a user's RSA key rather than the full key, allowing an attacker who knows a username and its modulus to craft a different key and log in with that account's privileges without possessing the private key. CVE-2026-86060 is a privilege escalation flaw triggered by SSH usernames beginning with a disallowed character, which can return a session with full administrative privileges. CVE-2026-67277 involves the bandwidth-test service allowing unauthenticated connections to reach an authenticated-only state, combined with uninitialized packet-buffer leakage and an integer underflow in size validation, potentially exposing kernel memory or crashing the device.
MS-ISAC states there are reports of these vulnerabilities being exploited in the wild, making this an active threat rather than a theoretical one. Affected systems are RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, spanning both stable and long-term branches, which affects a broad population of home, business, and ISP routers. Successful exploitation of the most severe flaw could grant an attacker full unauthenticated control of the device.
Defenders should prioritize applying MikroTik's stable channel update to all affected RouterOS devices after testing, and treat externally-exposed RouterOS instances with SSH or bandwidth-test services enabled as high priority for patching and scanning. Given active exploitation and the low complexity of gaining full device control, organizations running MikroTik infrastructure should also review SSH access logs and audit device management interfaces for unauthorized access or unexpected admin accounts.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mikrotik-routers-could-allow-for-admin-hijacking_2026-095
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs