Loading vulnerability…
SSH Rekey Authentication Bypass in MikroTik RouterOS
CVE-2026-67279 is an SSH state-machine vulnerability in MikroTik RouterOS. When a client initiates key renegotiation before user authentication completes, the SSH server incorrectly transitions from the temporary rekey state to connection-protocol channel handling instead of resuming authentication. An unauthenticated client can consequently open a session channel and issue an exec request. Affected builds dispatch commands that permit creation, overwriting, and reconstruction of files within the RouterOS-managed file namespace, including support files containing configuration and diagnostic data. The vulnerability does not independently establish an authenticated identity or full administrative privileges. It forms the first stage of the MikroTrick exploitation chain when combined with CVE-2026-86060.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses the SSH authentication workflow and exposes protected session and command-handling functionality. Direct consequences include unauthorized manipulation of RouterOS-managed files and exposure of configuration or diagnostic information. Chaining this vulnerability with CVE-2026-86060 can provide unauthenticated full administrative control; this takeover has been reproduced on vulnerable RouterOS 7.x devices. Administrative compromise can enable persistent accounts, configuration changes, traffic interception, and access to systems behind the router. The vulnerability is actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog on September 25, 2026.
If you can’t patch tonight, do this now.
Until patching is complete, disable SSH if unnecessary or restrict access through firewall rules to trusted administrative networks and addresses. Remove public and untrusted-network exposure, segment the management plane, and use a trusted VPN for remote administration. Monitor administrative activity and configuration changes. Strong passwords or SSH-key-only authentication do not address this pre-authentication workflow flaw.
Patch, then assume compromise.
Upgrade to RouterOS 6.49.21 or later in the applicable 6.x long-term branch, 7.23.4 or later in the applicable 7.x long-term branch, or 7.24.2 or later in the stable branch. Patching prevents subsequent exploitation but does not remove existing attacker accounts or persistence. Review previously exposed devices for unauthorized privileged users, configuration changes, scripts, schedulers, tunnels, proxies, and suspicious diagnostic-data transfers. If compromise is suspected, isolate the device, preserve logs and configuration, factory-reset and rebuild from a verified baseline, and rotate potentially exposed credentials and keys. Do not restore a backup from a compromised device.
5 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.