CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

Medium 6.3 Published 5 Sep 2026 Updated 17 Sep 2026

Attackers can impersonate TLS servers and bypass SSH authentication by exploiting flawed RSA signature validation in MikroTik RouterOS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-67278?

CVE-2026-67278 is a medium-severity vulnerability in Mikrotik Routeros, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication.

This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

Weakness: CWE-347

Which versions are affected by CVE-2026-67278?

It affects 1 product.

Products include Mikrotik Routeros.

How do I fix CVE-2026-67278?

No fix has been published for CVE-2026-67278 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-67278 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67278 exists.

All Mikrotik Routeros vulnerabilities

Sources

Also known as GHSA-cq44-x9vf-fpqg.