On 25 September 2026 CISA added MikroTik RouterOS CVE-2026-67279 to the Known Exploited Vulnerabilities catalog, with a federal due date of 28 September. CISA's entry says the bug lets an unauthenticated client open an SSH session channel and send an exec request, and that it can be chained to reach unauthenticated exploitation of CVE-2026-86060, which CISA had listed on 10 September.
MikroTik's own bulletin is blunter. Of the six RouterOS bugs CERT Polska reported under the name "MikroTrick", CVE-2026-67279 is "the issue that was seen being exploited in the wild". And on 6 October MikroTik admitted that one of the six fixes shipped in September was incomplete.
What's affected
NVD's description of CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted. On affected builds the server runs the requested command, which allows unauthenticated creation, overwrite and reconstruction of files in the RouterOS file namespace. Paired with CVE-2026-86060, a crafted username that changes the session's policy mask, CERT Polska says the result is full control of the device for anyone who can reach its SSH port.
MikroTik's bulletin lists all six CVEs:
| CVE | Area | Fixed in |
|---|---|---|
| CVE-2026-67279 | SSH command execution without login | 7.24.2, 7.23.4, 6.49.21 |
| CVE-2026-86060 | SSH username privilege escalation | 7.24.2, 7.23.4, 6.49.21 |
| CVE-2026-67276 | SSH public key auth without private key | 7.24.2, 7.23.4, 6.49.21 |
| CVE-2026-67281 | WebFig unauthenticated file read (7.20 and newer) | 7.24.2, 7.23.4 |
| CVE-2026-67278 | Forged TLS certificates and SSH host keys (RouterOS 7) | 7.24.3, 7.23.6 |
| CVE-2026-67277 | Bandwidth test crash and memory leak | 7.24.2, 7.23.4, 6.49.21 |
The row to notice is CVE-2026-67278. MikroTik's 6 October update says the fix in 7.24.2 and 7.23.4 was incomplete. If you upgraded in September, you need to upgrade again. The safe targets are 7.24.3 or later on the stable channel, 7.23.6 or later on long-term, and 6.49.21 or later on RouterOS 6, which is not affected by the certificate bug.
How to check if you're exposed
Check the installed version on each router:
/system resource print
/system package update print
Anything below the targets above needs work. Then check who can reach SSH, WebFig and the bandwidth test server:
/ip service print
/tool bandwidth-server print
/ip firewall filter print where chain=input
If ssh is enabled with no address restriction and no input firewall rule limiting it to a management network, the router is reachable by the exploited chain. The same check on www and www-ssl tells you whether CVE-2026-67281 is reachable on RouterOS 7.20 and newer.
Next, look for signs of compromise. CERT Polska says the observed attacks left these log entries:
login failure for user -2 from <ip> via ssh
user <name> added by ssh:-2@<ip>
Search the log and the user list:
/log print where message~"user -2"
/log print where message~"ssh:-2@"
/user print
CERT Polska lists a highly privileged user named ops as an indicator. It says the successful attacks it saw, including creation of that account, came from 82.192.72.4 since at least 2 September, and that 103.102.31.18 was used in attempts.
Fixed releases also scan the configuration at boot for known signs of tampering and set a "Flagged" marker. Check it after upgrading:
/system device-mode print
CERT Polska warns that a clean result does not prove the device is safe. The check only finds selected traces.
What to do now
- Upgrade to 7.24.3, 7.23.6 or 6.49.21 or later. Do this even on routers you upgraded to 7.24.2 or 7.23.4 in September.
- Close SSH and WebFig to the internet. MikroTik recommends allowing only trusted IPs, or better, a VPN such as WireGuard for management with no management ports exposed.
- Until upgraded, CERT Polska advises not initiating TLS connections from the device and not using the built-in
/system sshand/system ssh-execclients over untrusted networks, because of the certificate bug. - After upgrading, review users, scripts, scheduler entries, proxy settings and tunnels for anything you didn't create.
- If the device is Flagged or you find the indicators above, isolate it, secure logs and configuration first, then reset to factory settings and rebuild from a trusted configuration. CERT Polska says not to restore a full backup from a possibly compromised device and not to clear the Flagged marker until analysis is done. Rotate every password and key the router held.
Why it matters
Small edge routers rarely get the patch discipline that servers get, yet they sit on the path for all traffic at a branch or small ISP. This chain needed only a reachable SSH port, and CERT Polska says successful attacks against internet-facing devices date back to at least 2 September, a day before MikroTik's bulletin.
The incomplete fix is the broader lesson. "We patched in September" is a statement about a version number on a date. If the vendor later revises the fix, your compliance record is wrong until someone checks again. Track fixed versions per CVE, and re-check them when advisories are updated.
CERT Polska also says the six bugs were found by its researcher using LLM-driven agent tooling that modeled protocols as state machines and tested skipped or out-of-order steps. CVE-2026-67279 is that exact class of bug: a protocol step that should have required login, reached without it.
Try it yourself
Pick one RouterOS device in a lab. Run /ip service print and /ip firewall filter print where chain=input, then write a single input rule that allows SSH and WebFig only from your management subnet. Confirm from another network that the ports no longer answer. Then see how monitoring catches advisory changes after you think you are done:
Click through it at your own pace, or open it full screen.
Quick check
I upgraded to 7.24.2 in September. Am I done?
No. MikroTik says the CVE-2026-67278 fix in 7.24.2 and 7.23.4 was incomplete. Upgrade to 7.24.3 or 7.23.6, or a later release.
Which MikroTrick CVE was exploited in the wild?
MikroTik's bulletin names CVE-2026-67279. CERT Polska says attackers combined two of the bugs to take full control of devices with SSH reachable from public networks.
Does a router without the Flagged marker prove it was not compromised?
No. CERT Polska says the check only detects selected traces of compromise.
