Full Report
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060
Analysis Summary
# Vulnerability: Multiple Flaws in MikroTik RouterOS (SSH Exploitation)
## CVE Details
- **CVE ID:** CVE-2026-67276, CVE-2026-67277, CVE-2026-86060
- **CVSS Score:** Not explicitly listed in the text, but categorized as **Critical/High** due to KEV inclusion.
- **CWE:**
- **CWE-306:** Missing Authentication for Critical Function (CVE-2026-67277)
- **CWE-88:** Argument Injection (CVE-2026-86060)
- **CWE-347:** Improper Verification of Cryptographic Signature (CVE-2026-67276)
## Affected Systems
- **Products:** MikroTik RouterOS
- **Versions:**
- RouterOS 6.x (Prior to 6.49.21)
- RouterOS 7.x Long-Term (Prior to 7.23.4)
- RouterOS 7.x Stable (Prior to 7.24.2)
- RouterOS Development Branch (Prior to 7.25 beta 3)
- **Configurations:** Systems with the **SSH service** exposed to the Internet are at the highest risk.
## Vulnerability Description
Three distinct vulnerabilities impact the security of MikroTik devices:
1. **CVE-2026-67277:** A lack of authentication for critical functions that allows remote attackers to harvest sensitive information.
2. **CVE-2026-86060:** An argument injection flaw allowing remote attackers to escalate their privileges within the system.
3. **CVE-2026-67276:** A cryptographic flaw where improper signature verification allows an attacker to forge a valid signature, enabling them to open an SSH command channel as a target user without possessing the required private key.
## Exploitation
- **Status:** **Exploited in the wild.** CVE-2026-67277 and CVE-2026-86060 have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Information disclosure and unauthorized access).
- **Integrity:** High (Privilege escalation and command execution).
- **Availability:** High (Potential for full device takeover).
## Remediation
### Patches
Update to the following fixed versions immediately:
- **RouterOS 6.x:** Version 6.49.21
- **RouterOS 7.x Long-Term:** Version 7.23.4
- **RouterOS 7.x Stable:** Version 7.24.2
- **RouterOS Development:** Version 7.25 beta 3
### Workarounds
- **Disable SSH:** If not required, disable the SSH service.
- **Access Control Lists (ACLs):** Restrict SSH access to trusted source IP addresses only.
- **Firewalling:** Ensure management interfaces are not exposed to the public internet.
## Detection
- **Indicators of Compromise:** Check system logs for a critical entry indicating the device has been **"Flagged"**.
- **Detection methods:**
- Monitor authentication logs for unusual or successful logins from unknown IPs.
- Audit for unauthorized configuration changes or new user accounts.
- If a "Flagged" status is found, refer to the MikroTik manual for device recovery/mode status.
## References
- MikroTik Security Bulletin: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060#fn1
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
- CISA KEV Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- MikroTik "Flagged" Status Guide: hxxps[://]manual[.]mikrotik[.]com/docs/system-information-and-utilities/device-mode/#flagged-status