CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow
Unauthenticated attackers can bypass SSH authentication to create, overwrite, or reconstruct files in MikroTik RouterOS, exposing configuration and diagnostic data.
- Exploited in the wild
- Since 25 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67279?
CVE-2026-67279 is a medium-severity authentication bypass vulnerability in Mikrotik Routeros, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Weakness: CWE-841
Which versions are affected by CVE-2026-67279?
It affects 1 product.
Linux distribution packages (1)
sshamble openSUSE:Tumbleweed | All versions | 0.3.12-1.1 |
Products include Mikrotik Routeros.
How do I fix CVE-2026-67279?
Upgrade to a fixed version. US federal agencies must fix it by 28 Sep 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-67279 being exploited?
Yes. Attackers have exploited CVE-2026-67279 in the wild since at least 25 Sep 2026.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Mikrotik Routeros
- CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow
- CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command
- CVE-2018-14847 MikroTik Router OS Directory Traversal
- CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function
- CVE-2017-20149 Memory corruption in n/a
Sources
Also known as GHSA-pqp3-gjgf-83cf, openSUSE-SU-2026:11737-1.