MikroTik RouterOS unauthenticated remote access vulnerabilities #
MikroTik disclosed certain versions of RouterOS are affected by multiple vulnerabilities:
CVE-2026-67276: An improper signature verification of a cryptographic signature vulnerability found within the RouterOS SSH service. Successful exploitation allows a remote, unauthenticated attacker the ability to bypass authentication if an authorized username and RSA modulus is known. The vulnerability has been designated CVE-2026-67276 and has been rated critical with a CVSS score of 9.2.
CVE-2026-86060: An improper neutralization of argument delimiters in a command vulnerability also found within the RouterOS SSH service. Successful exploitation allows a remote, unauthenticated attacker the ability to achieve full administrative control via a crafted username. The vulnerability has been designated CVE-2026-86060 and has been rated critical with a CVSS score of 9.2.
CVE-2026-67277: A memory disclosure and DoS vulnerability within the RouterOS bandwidth-test service. Successful exploitation allows a remote, unauthenticated attacker the ability to read kernel memory or trigger a DoS. The vulnerability has been designated CVE-2026-67277 and has been rated high with a CVSS score of 8.8.
MikroTik has confirmed that these vulnerabilities are being actively exploited in the wild.
The following versions are affected:
- RouterOS: Versions 7.24 through 7.24.1
- RouterOS: Versions 7.0.0 through 7.23.3
- RouterOS: Versions 6.0.0 through 6.49.20
What is MikroTik RouterOS? #
Mikrotik RouterOS is a Linux-based operating system that provides routing, firewall, and bandwidth management capabilities for Mikrotik RouterBOARD hardware. It is frequently utilized by internet service providers and small-to-medium businesses to manage core network infrastructure.
What is the impact? #
Successful exploitation of these vulnerabilities could allow a remote, unauthenticated attacker administrative privileges to achieve full system takeover.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- RouterOS: Upgrade to version 7.24.2 or later.
- RouterOS: Upgrade to version 7.23.4 or later.
- RouterOS: Upgrade to version 6.49.21 or later.
Finding exposed MikroTik systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="MikroTik RouterOS" AND ((os_version:>="6.0.0" AND os_version:<"6.49.21") OR (os_version:>"7.0.0" AND os_version:<"7.23.4") OR (os_version:>"7.24" AND os_version:<"7.24.2"))
