CVE-2026-67279 Mikrotik RouterOS
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches…
- CVSS
- 6.9 Medium
- EPSS
- 2.3%
- Percentile
- 83
- Published
- 2026-09-05
- Force
- 9 of 12
- Public PoC
- 4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
On CISA’s exploited list
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- Added
- 2026-09-25
- Federal patch deadline
- 2026-09-28
- Ransomware use
- not known