AI analysis
CVE-2026-67279 is an authentication-ordering flaw (CWE-841) in the SSH server of MikroTik RouterOS: after a client-requested SSH rekey, the server enters the connection protocol even though user authentication was never attempted. An unauthenticated SSH client can therefore open a session channel and send an exec request, and on affected builds the server dispatches the command without any credentials. This lets the attacker create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data. Any MikroTik device running RouterOS builds older than the fixed releases is affected, although remote exploitation requires the SSH service to be reachable by the attacker. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.4% probability of exploitation in the next 30 days, so no exploitation is currently known.
What to do: Upgrade RouterOS to 6.49.21 (Long-term v6), 7.23.4 (Long-term v7), or 7.24.2 (Stable). Until patched, restrict SSH access to trusted management networks/VPN or disable the SSH service where it is not needed. Review the RouterOS file list and SSH logs for unexpected or reconstructed files and session activity, since attackers have recently chained multiple MikroTik flaws against routers.
Affected
| MikroTik RouterOS (Long-term branch, v6) | prior to 6.49.21 |
| MikroTik RouterOS (Long-term branch, v7) | prior to 7.23.4 |
| MikroTik RouterOS (Stable branch, v7) | prior to 7.24.2 |
Estimated exposure
massmillions of installed RouterOS devices, with plausibly hundreds of thousands of SSH-exposed systems — MikroTik RouterOS runs on millions of routers across home, ISP, and enterprise deployments and public internet-wide scans routinely index very large RouterOS SSH populations, though only devices with SSH enabled and reachable from…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)