CVE-2026-67279

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

Exploited in the wild. In CISA KEV since 2026‑09‑25. A vendor fix is available.

CVSS 3.16.5Medium EPSS percentile51st0.7% chance in 30 days CISA KEVListedsince 2026-09-25, due 2026-09-28
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-05Updated 2026-09-26Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check each RouterOS device’s installed version and whether its SSH service can be reached from outside your trusted administration network.
Update to RouterOS 6.49.21 on the 6.49 long-term branch, 7.23.4 on the 7.23 long-term branch, or 7.24.2 on the stable branch.
Until updated, disable SSH if unused or restrict it to specific trusted administrator addresses.
Review RouterOS files and administrative activity for unexpected changes after updating.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

In plain language

Written by AI from the record

RouterOS versions before 6.49.21, 7.23.4, or 7.24.2 can let an outsider run commands without signing in, so small businesses using it should update urgently.

Unauthenticated SSH pre-authentication state bypass via client-requested rekey permits session-channel exec requests and file operations in RouterOS managed storage.

If you're affected

Unauthorized router changes
Configuration data exposure
Diagnostic file tampering
Network service disruption

What is it

This is a flaw in the remote-management door used by RouterOS. Under a particular sequence of connection steps, it can treat a visitor as though they had passed reception without ever checking their identity, allowing them to issue commands and alter stored support files.

Who is affected

This matters to you if you run RouterOS on business network equipment and use SSH for administration. An attacker does not need a login for this issue. It is only a risk if RouterOS SSH is reachable by an attacker.

How urgent is it

An attacker who can reach the SSH service can attempt to send commands without signing in, which makes this a red-priority issue. No public exploit code is on record and it is not listed in CISA’s Known Exploited Vulnerabilities catalog, but exposed devices should be updated promptly.

What to do — in detail

Confirm the installed RouterOS version on every device and identify SSH listeners reachable from the internet or untrusted networks. Upgrade within the matching release line: 6.49.x to 6.49.21, 7.23.x to 7.23.4, or the stable line to 7.24.2; review the vendor’s release notes and back up the configuration before any branch change.

If patching must wait, disable SSH where it is not required, or limit SSH access with firewall rules to dedicated administrator addresses or a trusted management network. After remediation, inspect the RouterOS managed file namespace for unexpected created, overwritten, or reconstructed support files, and review administrative and SSH-related activity for unexpected command execution. No CISA KEV remediation due date applies because this CVE is not listed in KEV.

Technical context

CWE-841 (improper enforcement of behavioral workflow) in RouterOS SSH pre-authentication rekey handling. A client-requested rekey can move the connection into the protocol state before authentication, allowing an unauthenticated session channel and exec request; affected behavior includes managed-file creation, overwrite, and reconstruction. No public exploit code is on record, and CISA KEV does not list this CVE. EPSS predicts 0.4% likelihood of exploitation (38th percentile), with a flat trend; this is predictive data, not evidence of observed exploitation. Pulse reports rising press attention attributed to exploitation, but no confirmed exploitation finding was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS51st

CISA KEV

Listed as exploited in the wild since 2026-09-25.

US federal agencies must remediate by 2026-09-28.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 51st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by added to CISA KEV.

Lifecycle

16 events over 21 days, from the signal feeds we watch.

2026-09-26Patch availableworkaround available, record updated
2026-09-25Added to CISA KEVpatch available, patch available, workaround available, workaround available, record updated, record updated
2026-09-08Record updatedrecord updated
2026-09-05OpenVAS check addedpublished, weakness classified, record updated

Affected products

Mikrotikcommercial · LVaka routeros, winbox
- RouterOSNetwork DeviceOn-premNetworking Infrastructure / router-switch

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact

Weaknesses

CWE-841No name in the record

Sources

References in the record

And 6 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for RouterOS, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account