CISA Adds MikroTik RouterOS SSH Flaw CVE-2026-67279 to KEV Catalog

CISA added CVE-2026-67279, a MikroTik RouterOS vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on September 25, with a federal remediation deadline of September 28.

The bug lets an unauthenticated client run commands over SSH. According to the NVD record, RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted. That lets an unauthenticated client open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite and reconstruction of files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data.

CISA says it can be chained with an earlier RouterOS flaw. The KEV entry notes the bug can be chained to achieve unauthenticated exploitation of CVE-2026-86060, a RouterOS argument-delimiter vulnerability CISA added to the catalog on September 10. CISA classifies CVE-2026-67279 as an improper enforcement of behavioral workflow vulnerability (CWE-841).

Fixed RouterOS versions are available. The record says the issue is fixed in RouterOS 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable). NIST scores it 6.5 (Medium) on CVSS 3.1, while CERT.PL, which assigned the CVE, rates it 6.9 on CVSS 4.0. NVD first published the record on September 5.

CISA’s required action is to apply mitigations according to MikroTik’s instructions under Binding Operational Directive 26-04, or discontinue use of the product if mitigations are unavailable. It lists the flaw’s use in ransomware campaigns as unknown.