Canadian Centre for Cyber Securitypublished Sep 10, 19:50 UTC (5d ago)ingested Sep 10, 20:36 UTCCanadian Centre for Cyber Security2· 1 read

Part of a story covered by 3 sources: “MikroTik RouterOS flaws actively exploited for full router takeover; CISA adds two to KEV catalog with September 13 deadline” — merged summary and timeline →

AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060

highVulnerability exploited in the wildimportance 72CVE-2026-67276 CVE-2026-67277 CVE-2026-86060

AI summary · glm-5.3-flash

Canada's Cyber Centre warns of three exploited MikroTik RouterOS vulnerabilities affecting SSH-exposed devices; CISA added two to its KEV catalog.

The Canadian Centre for Cyber Security issued alert AL26-020 for three MikroTik RouterOS vulnerabilities, especially on devices exposing SSH to the internet: CVE-2026-67277 (missing authentication, CWE-306, enabling sensitive information disclosure), CVE-2026-86060 (argument injection, CWE-88, enabling privilege escalation), and CVE-2026-67276 (improper cryptographic signature verification, CWE-347, allowing SSH command channel access without the private key). On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog. Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.

CISA added CVE-2026-67277 and CVE-2026-86060 to the KEV database on September 10, 2026
CVE-2026-67276 lets attackers forge signatures and open SSH command channels as the target user without the private key
Cyber Centre urges prioritizing internet-exposed SSH systems and checking logs for MikroTik 'Flagged' compromise indicators
MikroTik and CERT Polska guidance recommends immediate updates and log review for unauthorized access

Read the original

VendorsMikroTik Cisco

ProductsRouterOS

OrganizationsCanadian Centre for Cyber Security CISA CERT Polska

CountriesCanada United States Poland

Tagsmikrotik routeros ssh kev cisa patching network-security

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-67276	SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%). Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'.	9.2	<1%		MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)	mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service)	10d ago
CVE-2026-86060 +1 in the same advisory: …67277	Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV. Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').	9.2 group max	1%	KEV PoC ×2	MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) MikroTik RouterOS v7 (Stable channel) versions prior to 7.24.2 (fixed in 7.24.2)	mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN	10d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-67276

SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x

MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).

Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'.

9.2

<1%

MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)

mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service)

10d ago

CVE-2026-86060

+1 in the same advisory: …67277

Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation

CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.

Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').

9.2

group max

KEV PoC ×2

MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21)
MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4)
MikroTik RouterOS v7 (Stable channel) versions prior to 7.24.2 (fixed in 7.24.2)

mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN

10d ago

Full article510 words · extracted from cyber.gc.ca · click to collapse

Number: AL26-020
Date: September 10, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Cyber Centre is aware of vulnerabilities impacting MikroTik RouterOS devices, especially if the SSH service is exposed to the Internet ^{Footnote 1}.

In response to the vendor advisory released on September 3, 2026, the Cyber Centre released AV26-887 on September 8, 2026 ^{Footnote 2}.

Tracked as CVE-2026-67277^{Footnote 3}, this vulnerability is a Missing Authentication for Critical Function vulnerability (CWE-306) ^{Footnote 4} that may allow a remote attacker to obtain potentially sensitive information.

Tracked as CVE-2026-86060^{Footnote 5}, this vulnerability is an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability (CWE-88)^{Footnote 6} that may allow a remote attacker to escalate privileges.

Tracked as CVE-2026-67276^{Footnote 7}, this vulnerability is an Improper Verification of Cryptographic Signature (CWE-347)^{Footnote 8} that may allow an attacker to forge a valid signature and open an SSH command channel as the target user without the private key.

On September 10, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-67277 and CVE-2026-86060 to their Known Exploited Vulnerabilities (KEV) Database. ^{Footnote 9}^{Footnote 10}

Suggested actions

The Cyber Centre recommends that organizations using MikroTik RouterOS, review the MikroTik security bulletin^{Footnote 1} and update/upgrade the affected devices to the following vendor-supported fixed versions:

Upgrade affected Cisco ASA instances to a fixed version:

Affected product	Affected versions	Fixed versions
RouterOS 6.x	Versions prior to 6.49.21	Version 6.49.21
RouterOS 7.x Long-Term	Versions prior to 7.23.4	Version 7.23.4
RouterOS 7.x Stable	Versions prior to 7.24.2	Version 7.24.2
RouterOS Development Branch	Versions prior to 7.25 beta 3	Version 7.25 beta 3

The Cyber Centre recommends following guidance provided by MikroTik^{Footnote 1} and CERT Polska ^{Footnote 11} to immediately update RouterOS, along with checking logs for possible device compromise. If the logs have a critical entry saying device has been “Flagged”, MikroTik recommends following the instructions provided by the status site^{Footnote 12}.

The Cyber Centre also recommends organizations to:

Determine the current version of software on each appliance.
Prioritize patching for systems exposing SSH to the internet.
Monitor authentication logs and network activity for indications of unauthorized access.
After patching, verify that the appliance is running the updated version and review logs for unusual activity.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions^{Footnote 13} with an emphasis on the following topics:

Consolidate, monitor, and defend Internet gateways
Patch operating systems and applications
Harden operating systems and applications
Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email [email protected].

References

Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060