SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA listed actively exploited SharePoint RCE and MikroTik RouterOS flaws in the KEV catalog.
88
CVE-2026-67279
Unauthenticated SSH Session Bypass Enables File Writes in MikroTik RouterOS
CISA: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- CVSS 4.0
- 6.9 medium
- EPSS
- 2%p83
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-67279 is an authentication-ordering flaw (CWE-841) in the SSH server of MikroTik RouterOS: after a client-requested SSH rekey, the server enters the connection protocol even though user authentication was never attempted. An unauthenticated SSH client can therefore open a session channel and send an exec request, and on affected builds the server dispatches the command without any credentials. This lets the attacker create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data. Any MikroTik device running RouterOS builds older than the fixed releases is affected, although remote exploitation requires the SSH service to be reachable by the attacker. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.4% probability of exploitation in the next 30 days, so no exploitation is currently known.
What to do: Upgrade RouterOS to 6.49.21 (Long-term v6), 7.23.4 (Long-term v7), or 7.24.2 (Stable). Until patched, restrict SSH access to trusted management networks/VPN or disable the SSH service where it is not needed. Review the RouterOS file list and SSH logs for unexpected or reconstructed files and session activity, since attackers have recently chained multiple MikroTik flaws against routers.
| Product | Affected |
|---|---|
| MikroTik RouterOS (Long-term branch, v6) | prior to 6.49.21 |
| MikroTik RouterOS (Long-term branch, v7) | prior to 7.23.4 |
| MikroTik RouterOS (Stable branch, v7) | prior to 7.24.2 |
Estimated exposure
massmillions of installed RouterOS devices, with plausibly hundreds of thousands of SSH-exposed systems — MikroTik RouterOS runs on millions of routers across home, ISP, and enterprise deployments and public internet-wide scans routinely index very large RouterOS SSH populations, though only devices with SSH enabled and reachable from…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
KEVCISA Known Exploited Vulnerability
- Affected
- MikroTik RouterOS
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- mikrotik
- Products
- routeros
- Weakness
- CWE-841
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
11 storiesAI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS
MikroTrick chains two MikroTik RouterOS flaws for unauthenticated admin access, with exploitation seen before patches.
86
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
Attackers chained two MikroTik RouterOS SSH flaws to seize internet-exposed routers without authentication; CISA lists one in KEV.
86
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited Microsoft SharePoint and MikroTik RouterOS flaws to KEV, due September 28.
85
Hackers Exploit MikroTik Vulnerabilities to Take Over MikroTik Routers Without Authentication
Attackers chained SSH authentication bypass CVE-2026-67276 and privilege flaw CVE-2026-86060 to fully hijack internet-exposed MikroTik routers before patches existed.
85
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
CISA says attackers are exploiting critical WSO2 and Adobe Commerce flaws plus SharePoint and MikroTik bugs.
84
MikroTik Patches Critical Flaws Chained to Hack Routers
MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.
84
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited SharePoint and MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog.
80
MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login
Bishop Fox's MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to gain unauthenticated admin control of internet-exposed MikroTik RouterOS devices, with compromise evidence.
78
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
72