Loading vulnerability…
RSA SSH authentication bypass in MikroTik RouterOS
CVE-2026-67276 is an SSH public-key authentication bypass in MikroTik RouterOS 7.x. When matching a client-supplied RSA public key against an authorized user key, RouterOS compares the key type and modulus but omits the exponent. Signature verification then uses the client-supplied key. An attacker who knows an existing account's name and authorized RSA public-key modulus can submit a key with the same modulus and exponent one, forge an authentication signature, and open an SSH command channel as that user without possessing the private key. The vulnerability was fixed in RouterOS 7.23.4 Long-term and 7.24.2 Stable.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses SSH authentication and permits impersonation of the targeted account, with command-channel access limited to that account's privileges. The vulnerability does not independently grant privileges beyond those assigned to the user. It is distinct from the MikroTrick chain involving CVE-2026-67279 and CVE-2026-86060; full administrative compromise attributed to that chain should not be treated as an unconditional impact of this flaw.
If you can’t patch tonight, do this now.
Until patching is completed, disable unnecessary SSH access or restrict it to trusted management networks through firewall allowlisting and/or a VPN. Do not expose SSH directly to untrusted networks. Monitor for unauthorized SSH sessions and configuration changes. These exposure controls do not correct the RSA validation flaw or replace patching.
Patch, then assume compromise.
Upgrade affected RouterOS 7.x installations to 7.23.4 Long-term, 7.24.2 Stable, or a later applicable fixed release. Verify the installed version and inspect accounts, logs, and configurations for unauthorized changes. Patching does not remove modifications made during an earlier compromise. If compromise is suspected, isolate the device, preserve logs and configuration, reset and rebuild it from a trusted configuration on a fixed release, and rotate passwords and keys rather than restoring a potentially compromised backup.
7 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
98 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.