Story · 2 sources · 2 articlesfirst Sep 10, 19:50 UTCupdated Sep 11, 11:57 UTC (5d ago)1

Canada's Cyber Centre and CISA Warn of Three Exploited MikroTik RouterOS Vulnerabilities (CVE-2026-67276, CVE-2026-67277, CVE-2026-86060)

highExploit / PoCexploited in the wildimportance 78CVE-2026-67277 CVE-2026-86060 CVE-2026-67276

What's new: Canada's Cyber Centre issued alert AL26-020 for three exploited MikroTik RouterOS vulnerabilities; MikroTik and CERT Polska issued guidance recommending immediate updates and log review. - CISA added CVE-2026-67277 and CVE-2026-86060 to the Known Exploited Vulnerabilities catalog on September 10, 2026, with a September 13, 2026 mitigation deadline for federal agencies. - CISA designated…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

Canada's Cyber Centre (alert AL26-020) and CISA warn of three exploited MikroTik RouterOS vulnerabilities, especially on devices exposing SSH to the internet. CISA added CVE-2026-67277 and CVE-2026-86060 to its KEV catalog on September 10, 2026, with a…

The Canadian Centre for Cyber Security issued alert AL26-020 for three MikroTik RouterOS vulnerabilities being exploited, particularly on devices exposing SSH to the internet. On September 10, 2026, CISA added two of them, CVE-2026-67277 and CVE-2026-86060, to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 13, 2026 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306): Canada's Cyber Centre describes it as enabling sensitive information disclosure, while GBHackers reports it affects the bandwidth-test (btest) service and can expose kernel memory and cause denial of service. CVE-2026-86060 is an argument-injection flaw (CWE-88) enabling privilege escalation; GBHackers reports it lets attackers manipulate the trusted RouterOS policy mask, and CISA has designated it as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. The third flaw, CVE-2026-67276, involves improper cryptographic signature verification (CWE-347) that lets attackers forge signatures and open an SSH command channel as the target user without the private key. Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3. The Cyber Centre urges prioritizing internet-exposed SSH systems and checking logs for MikroTik 'Flagged' compromise indicators; MikroTik and CERT Polska guidance recommends immediate updates and log review for unauthorized access. Compromised routers could have altered routing rules, persistence, traffic interception, or be used as pivots into internal networks.

Canada's Cyber Centre issued alert AL26-020 for three MikroTik RouterOS vulnerabilities: CVE-2026-67277 (missing authentication, CWE-306), CVE-2026-86060 (argument injection, CWE-88), and CVE-2026-67276 (improper cryptographic signature…
CISA added CVE-2026-67277 and CVE-2026-86060 to the KEV catalog on September 10, 2026; federal agencies face a September 13, 2026 remediation deadline under KEV rules.
CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; the Cyber Centre characterizes it as enabling sensitive information disclosure.
CVE-2026-86060 (CWE-88) enables privilege escalation by manipulating the trusted RouterOS policy mask; CISA mandates forensic triage of this flaw under Binding Operational Directive 26-04.
CVE-2026-67276 (CWE-347) lets attackers forge signatures and open SSH command channels as the target user without the private key.
Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.
Defenders should prioritize internet-exposed SSH systems, restrict btest exposure, and review router logs for MikroTik 'Flagged' compromise indicators, unauthorized access, and tampering; compromised routers could have altered routing…

VendorsMikroTik CISA Cisco

ProductsRouterOS

OrganizationsCanadian Centre for Cyber Security CISA CERT Polska

CountriesCanada United States Poland

Coverage timelineoldest first · each row is one article

Sep 10, 19:50 UTC · 6d ago
Canadian Centre for Cyber Security· 72
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060
Canada's Cyber Centre warns of three exploited MikroTik RouterOS vulnerabilities affecting SSH-exposed devices; CISA added two to its KEV catalog.
Sep 11, 11:57 UTC · 5d ago
GBHackers· 78
CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert
CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-67276	SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%). Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'.	9.2	<1%		MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)	mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service)	11d ago
CVE-2026-86060 +1 in the same advisory: …67277	Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV. Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').	9.2 group max	1%	KEV PoC ×2	MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) MikroTik RouterOS v7 (Stable channel) versions prior to 7.24.2 (fixed in 7.24.2)	mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN	11d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-67276

SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x

MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).

Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'.

9.2

<1%

MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)

mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service)

11d ago

CVE-2026-86060

+1 in the same advisory: …67277

Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation

CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.

Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').

9.2

group max

KEV PoC ×2

MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21)
MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4)
MikroTik RouterOS v7 (Stable channel) versions prior to 7.24.2 (fixed in 7.24.2)

mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN

11d ago