Loading vulnerability…
Improper RSA signature verification in MikroTik RouterOS
CVE-2026-67278 is an improper cryptographic-signature verification vulnerability affecting MikroTik RouterOS 7.x. RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Its trust store contains a root CA with RSA public exponent e=3, allowing an attacker controlling or redirecting an outbound TLS connection to forge a trusted intermediate certificate using only the root's public certificate. The attacker can then issue certificates for arbitrary hostnames and impersonate TLS servers. The permissive verification also undermines RSA-based SSH authentication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can defeat TLS server authentication by presenting forged certificates that RouterOS accepts as trusted, enabling server impersonation and man-in-the-middle interception. This compromises the authenticity of affected TLS connections and can expose communications to interception. RSA-based SSH authentication is also undermined, although the precise SSH exploitation conditions and resulting access are not established.
If you can’t patch tonight, do this now.
Until patched, restrict RouterOS outbound TLS connections to trusted, controlled network paths. Prevent attacker-controlled DNS or routing changes, and apply network segmentation and egress controls to reduce opportunities for TLS interception or redirection. These controls reduce exposure but do not correct signature verification.
Patch, then assume compromise.
Upgrade affected RouterOS 7.x installations to 7.23.6 (Long-term), 7.24.3 (Stable), or a later release containing the complete fix. Versions 7.23.4 and 7.24.2 contain incomplete fixes and should not be considered sufficient remediation. Earlier advisory statements listing those releases as fixed conflict with the explicit complete-fix information. RouterOS 6.x is not affected according to the vulnerability-specific description.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.