September 2026 vulnerability

MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels.

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended.

Update 2026-10-06: this article now lists all six issues from the original report, including a corrected fix version for one of them (see below). The CVE numbers were initially withheld to give users time to upgrade.

Your device should already give you the option to upgrade software in the “Check for updates” menu.

Fix is included in:

• 7.25 beta 3
• 7.24.2
• 7.23.4
• 6.49.21

Important: the fix for one of the issues (CVE-2026-67278, forged certificates and SSH host keys) in 7.24.2 and 7.23.4 was found to be incomplete. The complete fix is included in 7.24.3 (stable) and 7.23.6 (long-term). If you already upgraded in September, please upgrade again to one of these versions or any later release. RouterOS 6 is not affected by this particular issue.

For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade.

Steps to be taken

Make sure SSH and the web interface (WebFig) are not open to any untrusted networks. MikroTik default configuration blocks these ports from the internet by default, but if you have manually opened them, make sure only trusted IP can access them, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all.

RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. If your log has a critical entry saying your device has been Flagged, please follow the instructions in the Flagged status documentation page.

Even if your device is not in Flagged state, after upgrading your RouterOS, inspect your device configuration for any unknown scripts, users or other config you do not recognise.

What was fixed

The issues were originally reported by CERT.pl under the codename “MikroTrick”. There are six CVE entries in total. In plain terms:

• CVE-2026-67279 – SSH. An attacker who can reach the SSH port could run commands on the router without ever logging in. This is the issue that was seen being exploited in the wild. Fixed in 7.24.2, 7.23.4 and 6.49.21.
• CVE-2026-86060 – SSH. A specially crafted username during SSH login could give the session more rights than the user should have. Fixed in 7.24.2, 7.23.4 and 6.49.21.
• CVE-2026-67276 – SSH. Under specific conditions, SSH public key authentication could be passed without the matching private key. Fixed in 7.24.2, 7.23.4 and 6.49.21.
• CVE-2026-67281 – WebFig. An attacker who can reach the web interface could read files from the router, including files containing credentials, without logging in. Affects RouterOS 7.20 and newer only, RouterOS 6 is not affected. Fixed in 7.24.2 and 7.23.4.
• CVE-2026-67278 – Certificates. The router could accept forged TLS certificates and SSH host keys, which allows an attacker on the network path to impersonate a server the router connects to. Affects RouterOS 7 only. Fixed in 7.24.3 and 7.23.6 (the fix in 7.24.2 / 7.23.4 was incomplete).
• CVE-2026-67277 – Bandwidth test. A crafted request to the bandwidth-test service could crash the router or reveal small amounts of memory contents. Fixed in 7.24.2, 7.23.4 and 6.49.21.

If your router is on 7.24.3, 7.23.6, 6.49.21 or any later release, all of the above are fixed.

Full technical details are available in the CERT.pl article and in the public CVE records.