MikroTik RouterOS SSH flaws chain into unauthenticated takeover
Direct answer
MikroTik RouterOS SSH flaws chain into unauthenticated takeover, also tracked as CVE-2026-67276 / CVE-2026-67279 / CVE-2026-86060 is a critical-severity threat campaign HOL Guard tracked from Sep 5, 2026 to Sep 25, 2026, verified against 6 primary sources and last reviewed Sep 25, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
MikroTik RouterOS SSH bugs in the MikroTrick cluster let attackers abuse exposed SSH. CVE-2026-67279 is an SSH pre-auth rekey state bypass that CISA added to KEV on 2026-09-25 (due 2026-09-28); it can chain with CVE-2026-86060 for unauthenticated admin access. CVE-2026-67276 is incomplete RSA public-key matching. Fixed in RouterOS 7.24.2, 7.23.4, and 6.49.21.
Also tracked as CVE-2026-67276 · CVE-2026-67279 · CVE-2026-86060 · MikroTrick
- First observed
- Sep 5, 2026
- Last observed
- Sep 25, 2026
- Last reviewed
- Sep 25, 2026
- Tracking ended
- Sep 25, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
Confirm your RouterOS train (6.x vs 7.x) before choosing the fixed build. Default RouterOS firewall blocks WAN SSH; risk is highest when SSH was manually exposed.
- Highest risk when SSH is reachable from untrusted networks; MikroTik default config blocks WAN SSH.
- CVE-2026-67279 alone opens a session/file write path; full unauth admin typically needs chaining with CVE-2026-86060.
- Fixed builds: 7.24.2, 7.23.4, 6.49.21.
- HOL blog is operator guidance, not a substitute for CERT.pl / MikroTik / CISA.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
No Guard coverage mapping or campaign-specific policy guidance is published for this record.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
CERT.pl disclosed MikroTrick / RouterOS SSH cluster including CVE-2026-67276 and siblings.
Sources:CERT.pl MikroTik RouterOS advisory·NVD CVE-2026-67276
- Update
HOL Guard published operator blog coverage for the MikroTrick cluster (CVE-2026-67276 lead).
Source:HOL Guard operator write-up
- Vendor action
CISA added CVE-2026-67279 (SSH rekey before auth) to the KEV catalog; federal due 2026-09-28; forensic triage No.
Sources:CISA KEV CVE-2026-67279·CISA alert adding SharePoint and MikroTik KEV entries
Publication clock: 482.1 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
RouterOS@>=7.24 <7.24.2 || >=7.0.0 <7.23.4 || >=6.0.0 <6.49.21mikrotikpackage
Sources
Every claim on this record is traceable to the sources below.
- CERT.pl MikroTik RouterOS advisorygovernment · observed September 25, 2026
- NVD CVE-2026-67276vulnerability database · observed September 25, 2026
- HOL Guard operator write-upother primary · observed September 25, 2026
- CISA KEV CVE-2026-67279government · observed September 25, 2026
- CISA alert adding SharePoint and MikroTik KEV entriesgovernment · observed September 25, 2026
- MikroTik September 2026 vulnerability bulletinvendor advisory · observed September 25, 2026
Campaign questions, answered
MikroTik RouterOS SSH bugs in the MikroTrick cluster let attackers abuse exposed SSH. CVE-2026-67279 is an SSH pre-auth rekey state bypass that CISA added to KEV on 2026-09-25 (due 2026-09-28); it can chain with CVE-2026-86060 for unauthenticated admin access. HOL Guard tracked the campaign from Sep 5, 2026 to Sep 25, 2026.
No. Active tracking ended Sep 25, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 6 primary sources, names 1 reviewed artifact, and was last fully reviewed Sep 25, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Confirm your RouterOS train (6.x vs 7.x) before choosing the fixed build. Default RouterOS firewall blocks WAN SSH; risk is highest when SSH was manually exposed.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-7E9381C6