CISA Confirms Which MikroTik Bug Unlocks Full Router Takeover
Security / news
CISA Confirms Which MikroTik Bug Unlocks Full Router Takeover
The agency's Sept. 25 catalog update settles a dispute between two security outlets over which flaw completes an unauthenticated router takeover chain.
An unauthenticated attacker who can reach a MikroTik router's SSH service over the internet can chain two RouterOS flaws into full administrative control, provided the device has not been updated since Sept. 3, according to a description the Cybersecurity and Infrastructure Security Agency added to its own catalog on Sept. 25.
CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog that day, two weeks after it added the escalation half of the same chain, CVE-2026-86060. Federal civilian agencies now have until Sept. 28 to patch both.
CISA's own entry for CVE-2026-67279 states plainly that the flaw "can be chained to achieve unauthenticated exploitation of CVE-2026-86060." The first bug lets an attacker open an SSH session without ever completing authentication, by exploiting how RouterOS handles a client-requested rekey. The second lets that session rewrite the router's trusted policy mask, according to CISA's own descriptions of both entries.
The disclosure behind both entries, dated
The chain traces to a single Sept. 5 advisory. CERT Polska, Poland's national computer emergency response team, credited researcher Sławomir Rozbicki with finding six RouterOS flaws. MikroTik had already shipped fixes on Sept. 3, two days before the public writeup, in versions 6.49.21, 7.23.4 and 7.24.2. Attackers began probing for the bug on Sept. 2, Help Net Security reported, citing CERT Polska's tracing of login attempts to the IP address 82.192.72.4. CISA added two of the six flaws, CVE-2026-67277 and CVE-2026-86060, to its catalog on Sept. 10. It took another 15 days to add CVE-2026-67279.
Two outlets named two different chains
Which bug actually pairs with CVE-2026-86060 was not settled before CISA's update. Help Net Security's Sept. 7 report described the takeover chain as CVE-2026-67276, a flaw in how RouterOS compares SSH host keys, combined with CVE-2026-86060, and scored both at 9.2. The Hacker News's Sept. 26 report on the new KEV entry described a different pairing: CVE-2026-67279, scored 6.9, combined with CVE-2026-86060.
CERT Polska's own advisory, read directly, credits Rozbicki with all six findings but does not itself state which two chain into administrative access. Of the advisories reviewed, only CISA's short description for CVE-2026-67279 says so outright, and it names CVE-2026-67279, not CVE-2026-67276, as the flaw that unlocks CVE-2026-86060.
What the six flaws carry, and what still isn't listed
| CVE | CVSS | Added to KEV |
|---|---|---|
| CVE-2026-67276 | 9.2 | Not yet, as of Sept. 27 |
| CVE-2026-67277 | 8.8 | Sept. 10 |
| CVE-2026-67279 | 6.9 | Sept. 25 |
| CVE-2026-86060 | 9.2 | Sept. 10 |
CVE-2026-67276 remains outside the KEV catalog as of Sept. 27, so federal civilian agencies face no CISA deadline to patch it, even though MikroTik fixed it in the same Sept. 3 release covered by our earlier report on the six-flaw disclosure. Whether it opens a separate, unconfirmed route into the same devices is not addressed in any of the advisories reviewed.
What patching does and doesn't fix
The Sept. 28 deadline binds only federal civilian agencies operating under Binding Operational Directive 26-04, the same directive CISA cited when it added a Zyxel switch flaw to the same catalog, covered here, a month earlier. Any RouterOS device already running 6.49.21, 7.23.4, 7.24.2 or later is fixed against the confirmed chain regardless of the KEV listing or the deadline attached to it.
What isn't yet answered is whether CISA will add CVE-2026-67276 in a future update, and whether doing so would confirm a second, independent path into the same routers.
Sources
- CISA Adds Two Known Exploited Vulnerabilities to Catalog, CISA
- Vulnerabilities in Mikrotik RouterOS software, CERT Polska
- MikroTik RouterOS SSH Vulnerabilities Exploited, Help Net Security
- SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild, The Hacker News
- CVE-2026-67279 record, National Vulnerability Database
Sources
More in Security
- 01Go Team Weighs Turning Off Default MPTCP After Linux FlawThe Go Security Team called a default change premature on Oct. 29, while commenters on golang/go issue 82717 split over keeping multipath TCP on.
- 02Anthropic's Claude Exploit Chains Hit Five Targets, Each With LimitsThe Frontier Red Team's Oct. 27 post covers Chrome, Safari, Android, Windows and Linux, but only the Chrome and Linux results reach code execution.
- 03A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 04Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.