RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
References
| Link | Resource |
|---|---|
| https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve | Third Party Advisory |
| https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ | Mitigation Third Party Advisory |
| https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 | Release Notes |
| https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 | Release Notes |
| https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 | Release Notes |
| https://mikrotik.com/supportsec/september-2026-vulnerability/ | Vendor Advisory |
| https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ | Exploit Third Party Advisory |
| https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279 | US Government Resource |
Configurations
Configuration 1 (hide)
|
History
25 Sep 2026, 17:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain - Third Party Advisory | |
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279 - US Government Resource |
25 Sep 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Sep 2026, 14:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* | |
| First Time |
Mikrotik routeros
Mikrotik |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve - Third Party Advisory | |
| References | () https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ - Mitigation, Third Party Advisory | |
| References | () https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 - Release Notes | |
| References | () https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 - Release Notes | |
| References | () https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 - Release Notes | |
| References | () https://mikrotik.com/supportsec/september-2026-vulnerability/ - Vendor Advisory | |
| References | () https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ - Exploit, Third Party Advisory |
Information
Published : 2026-09-05 20:17
Updated : 2026-09-26 04:17
NVD link : CVE-2026-67279
Mitre link : CVE-2026-67279
CVE.ORG link : CVE-2026-67279
JSON object : View
Products Affected
mikrotik
- routeros
CWE
CWE-841
Improper Enforcement of Behavioral Workflow