CVE-2026-67279: MikroTik RouterOS SSH Improper Behavioral Workflow Enforcement (CWE-841)
A workflow enforcement flaw in the SSH service of MikroTik RouterOS lets an unauthenticated client reach command handling and create, overwrite or reconstruct files in the router's managed file area. CISA lists the issue in its Known Exploited Vulnerabilities catalog, which confirms active exploitation. Affected branches should be updated to the fixed releases named by the vendor.
Overview
This issue affects the SSH service of MikroTik RouterOS. According to the record, the server moves into the connection protocol after a client-requested rekey without having completed user authentication, which lets an unauthenticated client reach command handling. The weakness class assigned in the record is CWE-841, Improper Enforcement of Behavioral Workflow.
Impact
- Unauthenticated creation, overwrite and reconstruction of files in the RouterOS managed file namespace.
- Possible exposure or modification of support files that contain configuration and diagnostic data.
- The NVD CVSS vector in the record rates confidentiality and integrity impact as low and availability impact as none, with a base score of 6.5.
Affected products and versions
The record lists Mikrotik RouterOS with these ranges:
- From 6.0 up to before 6.49.21.
- From 7.0 up to before 7.23.4.
- From 7.24 up to before 7.24.2.
Fixed releases named by the vendor are 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). See the vendor advisory and the release notes for 6.49.21, 7.23.4 and 7.24.2.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog lists this CVE with a date added of 2026-09-25 and a due date of 2026-09-28, so active exploitation is confirmed by CISA. The recorded ransomware use is Unknown. The record also gives an EPSS probability of 0.01046 and a percentile of 0.63892. CERT-PL published a technical advisory that treats the issue as actively exploited.
Remediation and mitigation
- Update affected devices to the fixed release for their branch: 6.49.21, 7.23.4 or 7.24.2.
- Follow the vendor mitigation instructions in the vendor advisory for any device that cannot be updated promptly.
- Limit access to the management SSH service to trusted networks and reduce internet exposure of router management interfaces.
- Prioritize patching according to exposure, as CISA's required action for this entry asks organizations to do.
Detection guidance
- Review SSH logs for unexpected connections from untrusted sources and for sessions that do not match administrative activity.
- Check the router's managed files and support files for unexpected creation, modification or missing items.
- Compare current configuration with trusted backups to identify unplanned changes.
- Keep logs of changes to device files and forward them to central monitoring where possible.
Limitations of the available information
The record does not include the full text of the vendor advisory, so the exact conditions that make a build vulnerable beyond the listed ranges are unknown. The record also does not state whether any particular exploitation campaign or affected population has been observed beyond the KEV entry and the CERT-PL advisory. Third-party analysis is referenced in the record but was not used for technical details here.
Frequently asked questions
Is this CVE being actively exploited?
Yes. CISA lists CVE-2026-67279 in its Known Exploited Vulnerabilities catalog with a date added of 2026-09-25, which confirms active exploitation.
Which RouterOS versions contain the fix?
The record names 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) as the fixed releases. Devices in the listed affected ranges should be updated to the fixed release for their branch.
What can an attacker affect according to the record?
The record describes unauthenticated creation, overwrite and reconstruction of files in the RouterOS managed file namespace, including support files with configuration and diagnostic data.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.