CVE-2026-67279

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated…

Medium Known exploited

Severity: 6.9 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 2.28%; Chance of exploitation in the next 30 days. Higher than 83.11% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Sep 25, 2026
Weakness: CWE-841 Improper Enforcement of Behavioral Workflow
Fix: None yet; No fixed version published

Exploited in the wild. Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (MikroTik RouterOS). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 28, 2026.

Description

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Not defined
Scope: X

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-841: Improper Enforcement of Behavioral Workflow

The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

References

Advisories

Timeline

Sep 5, 2026 Published
Sep 25, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Sep 26, 2026 Last updated by the source
Sep 28, 2026 Remediation due for U.S. federal agencies
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-26r5-4mm2-px5c Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace	High	Same weakness, CWE-841
GHSA-r4fx-v8hh-22mv vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)	High	Same weakness, CWE-841
GHSA-v358-wf77-39xv klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits	High	Same weakness, CWE-841
EEF-CVE-2026-43974 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM	High	Same weakness, CWE-841
GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection	Medium	Same weakness, CWE-841
GHSA-vcgp-9326-pqcp net-imap vulnerable to STARTTLS stripping via invalid response timing	High	Same weakness, CWE-841
GHSA-c7xw-p58w-h6fj Keycloak: Impersonation and lockout possible through incorrect handling of email trust	Medium	Same weakness, CWE-841
GHSA-x3rq-r3cm-5vc4 Publify Business Logic Errors	High	Same weakness, CWE-841

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor