Critical security vulnerabilities found in MikroTik RouterOS
On September 5th, CERT Polska published multiple CVEs affecting MikroTik's RouterOS. MikroTik has also published an official vulnerability notice a few days prior.
The discovered security issues enable a remote attacker to gain shell access (ssh service), read arbitrary files (webfig service) or cause service disruption via DoS (btest service).
Below the description of discovered CVEs from cert.pl:
CVE-2026-67276 - SSH authentication bypass (CVSS: 9.2)
RouterOS did not properly verify public keys used for SSH authentication - in particular, it did not compare the entire RSA public key assigned to a user. An attacker who knew the username and the public modulus of the user's key could craft a different key and log in via SSH without possessing the corresponding private key. The privileges obtained were equivalent to those of the targeted account.CVE-2026-86060 - SSH session privilege manipulation via a crafted username (CVSS: 9.2)
RouterOS did not properly handle usernames beginning with a disallowed character in the SSH login mechanism. By using a crafted username, an attacker could elevate their privileges. The resulting session had full administrative privileges in the RouterOS system.CVE-2026-67277 - memory disclosure and crash via bandwidth-test (CVSS: 8.8)
The bandwidth-test service allowed an unauthenticated connection to enter a state that should only be reachable after logging in. Combined with two separate flaws - disclosure of uninitialized data from the packet buffer and an integer underflow in size validation - this enabled kernel memory leakage or a remote DoS attack leading to a system restart.
The vulnerabilities have already been found to be exploited in the wild, if you run MikroTik RouterOS anywhere, it's necessary to upgrade to patched versions.
Those are currently: 7.25beta3 (Beta), v7.24.2 (Stable), v7.23.4 (Long-term), v6.49.21 (Long-term v6).