CVE-2026-67276 is a high severity SSH authentication bypass in MikroTik RouterOS 7. The record scores it 8.1 and CERT Polska scores it 9.2. CERT Polska reports active exploitation of a chain of two RouterOS flaws. Update to RouterOS 7.24.3 stable or 7.23.6 long-term, and check devices for signs of compromise.
What's affected
CERT Polska lists the vulnerable range as RouterOS 7.9 up to but not including 7.23.4, and 7.24 up to but not including 7.24.2. The issue affects the 7.x branch only. It was fixed in 7.23.4 (long-term) and 7.24.2 (stable).
Those versions are no longer the recommended targets. CERT Polska's later guidance says to install 7.24.3 or later on the stable channel, 7.23.6 or later on the long-term channel, and 6.49.21 or later on RouterOS 6. It says 7.24.2 and 7.23.4 held an incomplete fix for a different CVE in the same set, CVE-2026-67278, so those devices need a second update.
The record gives CVSS 8.1. CERT Polska's article gives 9.2 for this CVE. The weakness is CWE-347, improper verification of cryptographic signature.
CERT Polska describes the cause. RouterOS matched an SSH key to an authorized user by checking the key type and modulus but not the exponent, and verified the signature with the key the client supplied. An attacker who knew a user's public modulus could present a different key and log in as that user without the private key.
Is it exploited?
The record's KEV flag is false. CERT Polska states, though, that attacks are happening. It says it has confirmation that a combination of two of the six vulnerabilities, which it calls MikroTrick, is being exploited to take full control of devices whose SSH service is reachable from public networks. It says attacks have occurred since at least 2 September 2026. This CVE is described as the SSH authentication bypass among the most important of the six, and I could not tell from the text which two make up the chain, so treat this one as in scope.
How to check if you're exposed
Read the version on each router:
/system resource print
Anything older than the targets above should be updated. Then follow CERT Polska's guidance after the update. Check the logs for the device compromise message and the flagged marker in the output of the device mode print command. Look for unknown users, scripts, scheduler tasks, proxy servers and tunnels. CERT Polska names a highly privileged user called ops as an indicator, and lists source addresses 82.192.72.4 and 103.102.31.18 in its article. The absence of these traces does not prove a device is clean.
What to do now
- Update RouterOS to 7.24.3, 7.23.6 or 6.49.21, depending on your branch.
- Until you can patch, block SSH, WWW and the bandwidth test server from everything outside trusted management networks. CERT Polska says this is only a temporary measure.
- Check for the flagged marker, the ops account and unknown configuration items.
- If you suspect compromise, isolate the device, save logs and configuration, then reset to factory and rebuild from a trusted configuration. Do not restore a backup from the suspect device.
- Rotate passwords and keys used on the device.
Why it matters
A signature check is only useful if the key being checked is the one on file. Here the comparison skipped a piece of the key, so a forged key could pass. A router sits at the network edge, so a takeover gives an attacker a view of the traffic and a base for reaching inside.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this exploited in the wild?
The record's KEV flag is false, but CERT Polska reports active exploitation of a two vulnerability chain on RouterOS devices with SSH exposed. Treat it as exploited.
Is 7.24.2 enough?
Not any more. CERT Polska recommends 7.24.3 or later on stable, and 7.23.6 or later on long-term.
Sources
- CERT Polska advisory for the MikroTik RouterOS CVEs
- CERT Polska warning: RouterOS vulnerabilities actively exploited
- MikroTik forum: RouterOS 7.23.4 long-term released
Last reviewed: 18 October 2026.
