Full Report
CERT Polska has found 6 vulnerabilities (from CVE-2026-67276 to CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060) in Mikrotik RouterOS software.
Analysis Summary
# Vulnerability: Multiple Critical Flaws in MikroTik RouterOS
## CVE Details
- **CVE ID:** CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060
- **CVSS Score:** Not explicitly provided in text (Severity: High/Critical based on descriptions)
- **CWE:**
- CWE-347: Improper Verification of Cryptographic Signature (CVE-2026-67276, CVE-2026-67278)
- CWE-306: Missing Authentication for Critical Function (CVE-2026-67277)
- CWE-841: Improper Enforcement of Behavioral Workflow (CVE-2026-841)
- CWE-824: Access of Uninitialized Pointer (CVE-2026-67281)
- CWE-88: Argument Injection (CVE-2026-86060)
## Affected Systems
- **Products:** MikroTik RouterOS
- **Versions:**
- v7.24 below 7.24.2
- v7.0.0 below 7.23.4
- v6.0.0 below 6.49.21
- **Configurations:** Systems running SSH services, WebFig management interfaces, or btest (Bandwidth Test) services.
## Vulnerability Description
The reported vulnerabilities involve a wide range of critical failures in the RouterOS security architecture:
- **SSH Authentication Bypass (CVE-2026-67276):** Improper RSA public key comparison (omitting the exponent) allows an attacker with a known public modulus to forge a signature and gain access without a private key.
- **SSH Workflow Bypass (CVE-2026-67279):** A logic flaw during SSH rekeying allows unauthenticated clients to execute commands and manipulate the managed file namespace.
- **TLS Impersonation (CVE-2026-67278):** Acceptance of malformed RSA signatures allows attackers to forge trusted certificates for arbitrary hostnames using public root CA information.
- **WebFig Information Disclosure (CVE-2026-67281):** An uninitialized pointer in the `/jsproxy` path allows unauthenticated attackers to escape the WebFig namespace and read root-owned system files and credentials.
- **Btest Kernel DoS (CVE-2026-67277):** Unauthenticated "related" btest connections can trigger integer underflows, leading to kernel crashes and Denial of Service.
- **Privilege Escalation (CVE-2026-86060):** Argument injection during SSH login allows modification of the trusted policy mask.
## Exploitation
- **Status:** Actively exploited in the wild (referenced in the report)
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full file system access, credential disclosure, and traffic interception via TLS forgery)
- **Integrity:** High (Unauthorized file creation/overwrite and command execution)
- **Availability:** High (Kernel crashes and system instability)
## Remediation
### Patches
MikroTik has released the following updated versions to address these flaws:
- **v6.49.21** (Long-term branch)
- **v7.23.4** (Long-term branch)
- **v7.24.2** (Stable branch)
### Workarounds
- Disable SSH service if not required or restrict access via Firewall Filter rules to trusted IP addresses only.
- Disable WebFig/WWW services or restrict access to management subnets.
- Disable the Bandwidth Test (btest) server.
## Detection
- **Indicators of Compromise:**
- Presence of unauthorized files in the managed file namespace.
- Unexpected SSH login attempts or successful logins from unknown IPs without valid private keys.
- System logs showing unexpected reboots (related to kernel underflows).
- **Detection methods:** Audit user configuration for modified policy masks and review WebFig access logs for suspicious `/jsproxy` requests.
## References
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
- CVE Records: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-67276 (and others)
- MikroTik Security: hxxps[://]mikrotik[.]com/setting/security