CVE-2026-67276: Mikrotik Routeros vulnerability (CVSS 8.1)

Description

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Mikrotik Routeros≥ 7.24 < 7.24.2 · ≥ 7.9 < 7.23.4

Remediation

Fixed in

Mikrotik Routeros≥ 7.24.2

Patch & vendor advisories

https://mikrotik.com/supportsec/september-2026-vulnerability/

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/MitigationThird Party Advisory
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-67276 being actively exploited?

CVE-2026-67276 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 6.45%.

How severe is CVE-2026-67276?

CVE-2026-67276 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 6.45% probability of exploitation.

Which products are affected by CVE-2026-67276?

Affected products include Mikrotik Routeros.

How do I fix CVE-2026-67276?

Upgrade affected software to a fixed version, for example Mikrotik Routeros 7.24.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-67276 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo