CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- Record
CVE-2026-67279- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-841
- Updated
- 2026-11-02
EUVDEUVD-2026-72027
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- Record
EUVD-2026-72027- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pqp3-gjgf-83cf
RouterOS SSH enters the connection protocol after a client-requested rekey even though user...
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- Record
GHSA-pqp3-gjgf-83cf- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
CISA KEV No score
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
- Record
CVE-2026-67279- Weakness
- CWE-841
- Updated
- 2026-11-02
NVD
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- Record
CVE-2026-67279- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11737-1 No score
sshamble-0.3.12-1.1 on GA media
These are all security issues fixed in the sshamble-0.3.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11737-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sshambleopenSUSE:Tumbleweed |
before 0.3.12-1.1 | 0.3.12-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HackSpeak/CVE-2026-67279 | 2026-09-26 |
| PoC in GitHub | tc4dy/CVE-2026-67279-86060-Toolkit | 2026-09-27 |
| PoC in GitHub | shmaki4/CVE-2026-67279-Mikrotik-6.42-POC | 2026-10-08 |
| PoC in GitHub | GoldAden/mikrotrick-verifier | 2026-10-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-67279 is a medium vulnerability (CVSS 6.9) in Mikrotik Routeros, published September 5, 2026. CISA lists it as known to be exploited, since September 25, 2026. EUVD reports exploitation since September 25, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. Fixed in sshamble 0.3.12-1.1.
References
cert.pl/en/posts/2026/09/mikrotik-routeros-cve
npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain
mikrotik.com/supportsec/september-2026-vulnerability
forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
Show 6 moreShow less
bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279
nvd.nist.gov/vuln/detail/CVE-2026-67279
github.com/advisories/GHSA-pqp3-gjgf-83cf
suse.com/security/cve/CVE-2026-67279