CVE-2026-67278
Faulty signature verification in RouterOS 7 lets an attacker on the network path impersonate servers using forged certificates or SSH host keys.
If you use a MikroTik router, ask whoever manages it to install the latest supported RouterOS release: the complete-fix minimums are 7.24.3, 7.23.6 or 6.49.21 for the corresponding branch. Restrict SSH and WebFig to trusted management networks or a VPN, and have the configuration checked even if there is no Flagged warning. If compromise is suspected, have a professional isolate it, preserve logs, rebuild from a trusted configuration and replace exposed passwords and keys.
- Affects
- MikroTik routers running RouterOS
- Severity
- Critical
- Fixed in
- RouterOS 7.24.3 or later: complete fixes for all six flaws.
RouterOS 7.23.6 or later in the 7.23 branch: complete fixes for all six flaws.
RouterOS 6.49.21 or later in the 6.49 branch: all applicable fixes. - Being used in attacks
- Not known to be
- Made public
- 2 Sept 2026
Part of: MikroTik routers taken over without login through MikroTrick SSH flaws
Attackers used two RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, together to gain full administrative control without a password or SSH key. CERT Polska confirmed successful attacks from at least 2 September against routers whose SSH service was reachable from the internet. MikroTik's default configuration blocks internet access to management ports, so exposure depends on configuration. The 3 September updates stopped the observed attacks. However, a separate certificate and SSH host-key flaw, CVE-2026-67278, needed further RouterOS 7 fixes. MikroTik's 6 October revision confirms complete coverage in 7.24.3, 7.23.6 and 6.49.21, or later releases. CISA lists both MikroTrick components and the separate bandwidth-test flaw as exploited. The reviewed sources disclose no total of compromised routers or confirmation that attacks have ended. Updating does not establish that an earlier compromise has been cleaned up.
Fixed in the same update
- CVE-2026-67279Authentication bypass in RouterOS SSH
- CVE-2026-86060Privilege escalation in RouterOS SSH login
- CVE-2026-67277Unauthenticated RouterOS bandwidth-test memory disclosure
- CVE-2026-67276RSA public-key authentication bypass in RouterOS SSH
- CVE-2026-67281Unauthenticated file disclosure in RouterOS WebFig
Sources
- September 2026 vulnerability — revised 6 OctoberMikroTik · 6 Oct 2026
- Critical vulnerabilities in MikroTik RouterOS are being actively exploitedCERT Polska · 5 Sept 2026
- MikroTrick: technical analysis, disclosure process, and the use of LLM agentsCERT Polska · 22 Sept 2026
- Vulnerabilities in Mikrotik RouterOS softwareCERT Polska · 5 Sept 2026
- Known Exploited Vulnerabilities catalogue — official GitHub dataCISA · 30 Oct 2026
- RouterOS release history and changelogsMikroTik
- Device mode — Flagged statusMikroTik