Loading vulnerability…
CVE-2026-67276 is an improper cryptographic-signature-verification vulnerability in MikroTik RouterOS SSH RSA public-key authentication. When matching a client authentication key to an authorized key, RouterOS compares the key type and RSA modulus but omits the RSA public exponent. Signature verification is then performed using the client-supplied key. An attacker can submit a key using the authorized modulus and an exponent of one, allowing construction of a valid signature without the legitimate private key and authentication as the corresponding authorized user.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This 12-file Python repository is a lab-oriented PoC for the claimed CVE-2026-67276 RouterOS SSH public-key authentication bypass. Its core module, forge_67276.py, parses OpenSSH RSA public keys, constructs SSH RSA blobs with a victim modulus and e=1 exponent, creates RFC 8017 EMSA-PKCS1-v1_5 signature blocks, and includes a reference verifier. poc_67276.py is the primary network exploit: it uses a custom Paramiko PKey implementation to submit the forged key/signature, pins requested SSH RSA signature algorithms, tries each configured algorithm in a separate connection, and optionally runs a RouterOS command after successful authentication. The exploit requires no victim private key but does require the username and modulus of an authorized RSA key. selftest.py locally validates the cryptographic primitive against signatures generated by cryptography/OpenSSL-compatible routines and confirms that the forged signature verifies only when exponent 1 is used. The remaining scripts provision and operate a QEMU/CHR lab: console_setup.py configures RouterOS over a telnet-like serial console and downloads a public key from 10.0.2.2:8069; import_key.py uploads/imports that key by SFTP; bootstrap_password.py handles forced first-login password changes; sanity_real_key.py and run_cmd.py validate/use ordinary key authentication; and mon_type.py controls a local QEMU monitor Unix socket. The README documents lab topology, localhost SSH forwards, expected vulnerable-versus-patched results, and operational caveats, including that its reported 6.x result did not reproduce the claimed matcher behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated SSH authentication-bypass flaw in MikroTik RouterOS. An attacker knowing a valid username and the modulus of a legitimate RSA public key can submit a crafted key with a different exponent and establish an SSH session without the private key. It is used as the initial stage of the MikroTrick vulnerability chain.
One of several vulnerabilities in MikroTik RouterOS. The vulnerabilities are reported as actively exploited; a combination of two enables complete device compromise over SSH.
Vulnerabilità critica di bypass dell'autenticazione SSH in MikroTik RouterOS causata da una verifica inadeguata delle chiavi pubbliche RSA. Un attaccante remoto che conosca il nome utente e parte delle informazioni della chiave pubblica dell'account bersaglio può impersonare l'utente e ottenere accesso non autorizzato con i suoi privilegi.
A CVSS 9.2 MikroTik RouterOS SSH authentication-bypass flaw caused by improper RSA public-key verification. It enables unauthenticated login when an attacker knows a valid username and that user's public RSA key; combined with CVE-2026-86060, it yields full administrator control.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.