MikroTik RouterOS 7.0.x < 7.23.4 / 7.24.x < 7.24.2 X.509 Signature Validation Bypass (CVE-2026-67278)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by a certificate validation vulnerability. MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures duri...

MikroTik RouterOS 7.9 < 7.23.4 / 7.24.x < 7.24.2 SSH Authentication Bypass (CVE-2026-67276)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.9 prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by an authentication bypass vulnerability. RouterOS does not compare the complete RSA public key when matching ...

MikroTik RouterOS 7.20 < 7.23.4 / 7.24.x < 7.24.2 WebFig Unauthenticated File Read (CVE-2026-67281)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.20 prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by an information disclosure vulnerability. RouterOS WebFig contains an unauthenticated file-read vulnerabilit...

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation...

MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service...

MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 6.x prior to 6.49.21, or 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by multiple vulnerabilities : - RouterOS accepts a 'related' btest connection before...

Exploit for CVE-2026-67276

RouterOS SSH Modulus-Confusion Validator CVE-2026-67276 An...

MikroTik router flaws allow takeover without a password

CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The...

Vulnerabilities in MikroTik RouterOS

MikroTik has addressed several vulnerabilities in RouterOS. The first vulnerability relates to a flaw in the SSH authentication mechanism, where the exponent of RSA keys was not verified. As a result, attackers can forge RSA signatures and gain unauthorized access via SSH. The second vulnerabilit...

Exploit for CVE-2026-67276

CVE-2026-67276 - MikroTrik SSH Authentication Bypass Exploit...

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik allows a hacker to bypass security restrictions and gain read-only access to data.

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik is related to errors in verifying the cryptographic signature during the incorrect comparison of the RSA public key assigned to the user. Exploiting this vulnerability allows a malicious actor to...

The vulnerability in the built-in tool for measuring channel bandwidth on the RouterOS operating system of MikroTik routers allows a hacker to disclose sensitive information or cause service failures.

The vulnerability of the built-in tool for measuring channel bandwidth on the RouterOS operating system of MikroTik routers is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failur...

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik allows a hacker to increase their privileges.

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik is related to changes in the user trust policy mask due to the introduction or modification of arguments. Exploiting this vulnerability can allow a malicious actor to increase their privileges remote...

Exploit for CVE-2026-67276

MikroTrick lab PoC — CVE-2026-67276 RouterOS SSH public-key a...

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

Attackers are exploiting MikroTik routers with their Secure Shell SSH remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least...

CVE-2026-67277

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate...

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-86060

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...

CVE-2026-67281

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

CVE-2026-67279

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...