CVE-2026-67279: RouterOS SSH Auth Bypass Vulnerability

CVE-2026-67279 Overview

CVE-2026-67279 is an authentication bypass in the MikroTik RouterOS SSH server. The server incorrectly transitions into the SSH connection protocol phase after a client-initiated rekey, even when user authentication was never completed. An unauthenticated remote client can open a session channel and issue an exec request. The server processes the command and permits creation, overwrite, and reconstruction of files within the RouterOS managed file namespace, including support files that hold configuration and diagnostic data. MikroTik addressed the flaw in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). CERT PL has reported active exploitation of RouterOS vulnerabilities in the same disclosure window.

Critical Impact
Unauthenticated network-based attackers can write and overwrite files on the router, exposing configuration and diagnostic data and enabling persistent tampering.

Affected Products

MikroTik RouterOS 6.x Long-term prior to 6.49.21
MikroTik RouterOS 7.x Long-term prior to 7.23.4
MikroTik RouterOS 7.x Stable prior to 7.24.2

Discovery Timeline

2026-09-05 - CVE-2026-67279 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-67279

Vulnerability Analysis

The flaw resides in the SSH state machine of RouterOS. The Secure Shell protocol requires a client to successfully complete the user authentication phase (ssh-userauth) before the server accepts messages belonging to the connection protocol (ssh-connection). RouterOS violates this ordering when the client requests a key re-exchange (rekey). After the rekey completes, the server treats the session as authenticated even though no authentication attempt occurred.

An unauthenticated attacker can then send SSH_MSG_CHANNEL_OPEN for a session channel and follow it with an exec channel request. The server dispatches the requested command against the RouterOS managed file namespace. This gives the attacker the ability to write, overwrite, and reconstruct files, including support files that contain sensitive configuration and diagnostic material. This mismatch between advertised protocol state and actual authentication state maps to [CWE-841: Improper Enforcement of Behavioral Workflow].

Root Cause

The RouterOS SSH server does not gate the transition to the connection protocol on prior successful authentication when handling a rekey. The rekey handler resets or advances protocol state without validating that ssh-userauth returned success. Independent analysis of the silent patch in 7.23.4 documents the missing state check, described in the NPratley research on the RouterOS 7.23.4 fix.

Attack Vector

Exploitation requires only network access to the SSH service (typically TCP/22) and no credentials or user interaction. An attacker completes an initial key exchange, immediately requests a rekey without submitting an SSH_MSG_USERAUTH_REQUEST, then opens a session channel and sends an exec request. The command runs in the context of the router's file management surface, yielding unauthenticated file write primitives. Further technical context is provided in the CERT PL advisory and the MikroTik September 2026 security bulletin.

Detection Methods for CVE-2026-67279

Indicators of Compromise

Unexpected creation, modification, or reappearance of support files (for example .rif, supout.rif) or files under the RouterOS managed file namespace without a corresponding administrator session.
SSH sessions from unfamiliar source addresses that establish, rekey, and open a channel but produce no successful authentication event in the router logs.
Configuration drift or new scripts, scheduler entries, or export files that were not deployed by an authorized change process.

Detection Strategies

Alert on RouterOS SSH connections that reach the connection-protocol stage without a preceding successful user login log entry.
Correlate SSH connection duration and byte counts with authentication events; long or data-transferring sessions with no auth success are suspicious.
Hunt for anomalous exec activity by baselining normal administrative SSH usage per device and flagging deviations from source IP, hour, or command volume.

Monitoring Recommendations

Forward RouterOS syslog to a centralized platform and retain SSH, system, and file events for retrospective review.
Monitor northbound and management interfaces for unexpected SSH traffic and enforce allowlists at the network edge.
Periodically verify integrity of router configuration exports and support files against a known-good baseline.

How to Mitigate CVE-2026-67279

Immediate Actions Required

Upgrade all RouterOS devices to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) or later, following the MikroTik 6.49.21 release notes, 7.23.4 release notes, and 7.24.2 release notes.
Restrict SSH access to management networks only using firewall rules and address lists on the router itself.
After patching, rotate credentials, API tokens, and any secrets that may have been present in exported support or configuration files.

Patch Information

MikroTik released fixed builds in RouterOS 6.49.21, 7.23.4, and 7.24.2. Refer to the MikroTik September 2026 vulnerability advisory for the authoritative fix listing and to the CERT PL exploitation notice for context on in-the-wild activity affecting the RouterOS platform.

Workarounds

Disable the RouterOS SSH service on devices where it is not required (/ip service disable ssh).
Bind the SSH service to a dedicated management VRF or restrict /ip service ssh address= to trusted CIDR ranges.
Block inbound TCP/22 to RouterOS devices at the perimeter and require VPN or jump-host access for administration until patching completes.

bash

# Configuration example: restrict SSH to a trusted management subnet
/ip service set ssh address=192.0.2.0/24
/ip firewall filter add chain=input protocol=tcp dst-port=22 \
    src-address=!192.0.2.0/24 action=drop comment="Block untrusted SSH"