CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

Overview

CISA has added CVE-2026-67279, an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS, to its Known Exploited Vulnerabilities (KEV) catalog on September 25, 2026, based on confirmed active exploitation. The flaw sits in RouterOS's SSH implementation and lets an unauthenticated client reach a state that should require completed authentication — opening a session channel and issuing an exec request that the router actually dispatches.

What makes this critical is the chain: researchers have confirmed CVE-2026-67279 can be paired with CVE-2026-86060, a critical SSH privilege-escalation bug CosmicBytez Labs covered when CISA first added it to KEV on September 10. Poland's CERT Polska dubbed the combined chain "MikroTrick" — taking an unauthenticated network client to full administrative control of a RouterOS device with no password, key, or completed login.

Technical Details

The gap between CVE-2026-67279's modest isolated score and its critical real-world severity is the point: NVD scores the primitive in isolation, but CISA's KEV listing treats it as the entry point of a chain ending in unauthenticated root-equivalent access to internet-facing network infrastructure — hence the critical rating on this advisory.

How It Works

RouterOS's SSH server is supposed to gate the post-authentication "connection protocol" — the phase where a client can open channels and request command execution — behind a completed login. CVE-2026-67279 breaks that gate: when a client requests a key re-exchange (rekey) mid-handshake, RouterOS advances into the connection protocol anyway, even though the client never authenticated. From there, the attacker opens an SSH session channel and sends an exec request, which affected builds dispatch — allowing unauthenticated creation, overwriting, and reconstruction of files inside RouterOS's managed file namespace, including support files holding configuration and diagnostic data.

The escalation comes from CVE-2026-86060: a separate flaw in RouterOS's SSH login helper where a username beginning with a prohibited (leading-dash) character isn't sanitized before being used as a command argument, letting an attacker rewrite the router's trusted policy mask. Chained together, CVE-2026-67279 gets an attacker into a session that should never have existed, and CVE-2026-86060 turns that session into one with full administrative rights.

Impact Assessment

Who Is At Risk

RouterOS runs on millions of MikroTik routers, switches, and wireless access points deployed by ISPs, enterprises, and home-lab operators worldwide. The Shadowserver Foundation has identified more than 122,500 internet-reachable MikroTik devices with SSH exposed, concentrated in Brazil, the United States, Indonesia, Czechia, and Ukraine. CERT Polska logged exploitation attempts as early as September 2, 2026 — a day before MikroTik's patches shipped on September 3. Any organization exposing RouterOS's SSH interface directly to the internet, rather than restricting it to a VPN or trusted management network, should treat itself as a probable target, not a hypothetical one.

Potential Attack Chains

• Unauthenticated session establishment (CVE-2026-67279) → privilege escalation (CVE-2026-86060) → full administrative control, with no credentials, keys, or user interaction at any stage
• Observed post-exploitation activity includes creation of rogue admin accounts — notably an SSH user literally named -2, a leading-dash trick that causes many enumeration and cleanup tools to misparse the username as a command-line flag — plus abuse of RouterOS's built-in scripting and scheduler engine for reboot-persistent access
• Full interception, redirection, or manipulation of traffic through a compromised router, credential and VPN-key theft, and use of the device as a pivot point for lateral movement into internal networks

Mitigation

Immediate Actions

• Upgrade RouterOS now to 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), or later — a single update closes both CVE-2026-67279 and CVE-2026-86060 along with several sibling CVEs CERT Polska disclosed in the same batch
• Disable SSH exposure to the internet wherever it isn't operationally required; restrict management access to a VPN or a defined set of trusted management IPs via firewall rules
• After upgrading, check the device's Log section for a "Flagged" status — RouterOS's post-update check will mark a device it believes was already compromised

Detection Opportunities

• Audit local user accounts for anything resembling -2 or other usernames beginning with a dash or other non-standard leading character
• Review SSH logs for connection attempts that complete a rekey without ever completing authentication
• Look for unexpected changes to policy masks, new administrative accounts, or scheduler/scripting entries that weren't operator-created
• Monitor for anomalous outbound traffic or firewall/NAT rule changes that don't match a known maintenance window

Defence-in-Depth

• Treat any internet-facing RouterOS SSH service as a standing risk regardless of patch status; default to management-network-only exposure
• Rotate credentials, VPN keys, and API secrets on any device suspected of compromise, and rebuild from a known-clean configuration rather than trusting an in-place cleanup
• Segment edge networking gear from core infrastructure so a compromised router can't pivot directly into sensitive segments

Background

CVE-2026-67279 is one of six RouterOS vulnerabilities (CVE-2026-67276 through CVE-2026-67281, plus CVE-2026-86060) that CERT Polska discovered and disclosed together in early September 2026. MikroTik shipped fixes across all release channels — including a 7.25 beta — on September 3, 2026, two days before public disclosure, but exploitation was already underway by the time patches landed.

CISA moved in two waves: CVE-2026-86060 (with the related CVE-2026-67277 missing-authentication flaw) was added to KEV on September 10. CVE-2026-67279 followed on September 25, once CISA confirmed independent active exploitation of the workflow-bypass primitive itself, landing in the same catalog update as an actively exploited Microsoft SharePoint flaw and sharing its September 28 federal remediation deadline. For the first time in company history, MikroTik pushed an in-app notification urging users to update — a sign of how seriously it's treating the "MikroTrick" chain.

References

• NVD — CVE-2026-67279
• CERT Polska — Vulnerabilities in MikroTik RouterOS software
• CISA Known Exploited Vulnerabilities Catalog
• MikroTik — September 2026 Security Vulnerability Advisory
• The Hacker News — Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
• CosmicBytez Labs — CVE-2026-86060: MikroTik RouterOS SSH Privilege Escalation