Zero Radar
← feed
CriticalVulnerabilityCVE-2026-67279updated 25 Oct 2026, 17:35 UTC

MikroTik RouterOS SSH lets unauthenticated users run commands

Attackers can reach the router's remote login service without a password and make it run commands. They can then create, overwrite, or read configuration and diagnostic files on the device.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 6.9 of 10
Being exploited?YesConfirmed by CISA KEV · 25 Sept 202
Fix available?Yes6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable) · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo password or account needed
  2. 2Connects to SSHClient requests a rekey
  3. 3Session opensAuthentication step is skipped
  4. 4Exec command runsServer executes attacker's request
  5. 5Files changedConfig and support files created or overwritten
  6. ResultAttacker controls router files and settings

What happened

A flaw in RouterOS SSH causes the server to enter the connection protocol after a client-requested rekey without requiring user authentication, allowing an unauthenticated client to open a session channel and send an exec request that the server executes.

Why it is dangerous: Routers sit at the network edge, so a compromised one can expose configuration data and let attackers change files or move further into the network. CISA reports this flaw can be chained with CVE-2026-86060 to achieve unauthenticated exploitation.

Are you affected?

You are affected if you run MikroTik RouterOS on an affected build with SSH enabled and reachable by untrusted clients.

MikroTik RouterOS affected builds (exact vulnerable version range not stated in the provided material).

What to do

  1. Update RouterOS to 6.49.21, 7.23.4 (Long-term) or 7.24.2 (Stable) or later
  2. If you cannot update right away, restrict SSH access to trusted management networks only
  3. Review the router's configuration and support files for unexpected changes, following CISA's forensics triage guidance
  4. Follow CISA BOD 26-04 guidance on prioritizing patches based on risk

Timeline

  1. 5 Sept 2026, 21:31 UTC
    Publicly disclosed
  2. 25 Sept 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable)

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-67279 · GHSA-pqp3-gjgf-83cf
CVSS
6.9 / 10
EPSS
2.3% chance of exploitation within 30 days
Disclosed
5 Sept 2026, 21:31 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MikroTik RouterOS SSH lets unauthenticated users run commands · Zero Radar