TLS server impersonation possible in Mikrotik RouterOS (CVE-2026-67278)

Why this deserves its current priority

CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Mikrotik/RouterOS (generic), Mikrotik/RouterOS (generic), Mikrotik/RouterOS (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:o:mikrotik:routeros::::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Mikrotik/RouterOSgeneric	>=7.24 <7.24.2 \|\| >=7.0.0 <7.23.4 \|\| >=6.0.0 <6.49.21	7.24.2, 7.23.4, 6.49.21
Mikrotik/RouterOSgeneric	>=7.24 <7.24.2 \|\| >=7.0.0 <7.23.4	7.24.2, 7.23.4
Mikrotik/RouterOSgeneric	>=7.24 <7.24.3 \|\| >=7.0.0 <7.23.6	7.24.3, 7.23.6

Recommended response

Check inventory. Check lockfiles and deployed manifests for Mikrotik/RouterOS, Mikrotik/RouterOS, Mikrotik/RouterOS.
Review the reported fix. Update Mikrotik/RouterOS to 7.24.2; Mikrotik/RouterOS to 7.24.2; Mikrotik/RouterOS to 7.24.3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 5, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 5, 2026

Sources and claim methodology

Upstream source description

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

Quoted source text, attributed separately from HOL analysis.

TLS server impersonation possible in Mikrotik RouterOSCVE-2026-67278

Key facts