RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication…

CVE-2026-67279 is a state-machine flaw in MikroTik RouterOS's SSH server (all versions from 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24.0–7.24.1). When a client initiates an SSH key renegotiation (SSH_MSG_KEXINIT) *before* completing user authentication, the server incorrectly advances to the connection protocol — the stage where session channels and exec requests are allowed. An unauthenticated client can then open a session channel and issue exec commands that create, overwrite, or reconstruct files in RouterOS's managed file namespace, including support bundles, diagnostic exports, and configuration-adjacent data. MikroTik patched silently on September 3, 2026 in versions 6.49.21, 7.23.4, and 7.24.2. CERT Polska publicly disclosed the flaw on September 5.

The CNA (CERT Polska) published a CVSS 4.0 score of 6.9 MEDIUM via enrichment data, rating confidentiality and integrity impacts as Low and availability as None. Taken in isolation, that might be fair — the exec primitive is limited to the managed file namespace, not arbitrary command execution. But the CNA score ignores two critical real-world factors. First, this vulnerability is actively exploited in the wild as part of the MikroTrick chain (CVE-2026-67279 + CVE-2026-86060), which converts the unauthenticated session into full administrative control. Second, every single RouterOS installation is a network edge device — a router, firewall, or wireless gateway — meaning any file-write primitive on the device threatens the entire network segment behind it. Shadowserver counted 122,500 devices with SSH exposed in a single 24-hour scan window. A MEDIUM label on an unauthenticated, zero-click, network-reachable flaw in perimeter infrastructure that is being chained to full takeover in active campaigns does not match reality.

1. Restrict SSH access to management VLAN or IP allowlist immediately — The attack requires TCP connectivity to the SSH port. Use RouterOS's /ip firewall filter to restrict SSH (port 22 or custom) to a management subnet or specific jump-host IPs. This eliminates the remote unauthenticated attack vector entirely. Because active exploitation evidence exists, deploy this control immediately — within hours, overriding the standard noisgate mitigation SLA of 30 days for HIGH. Example: /ip firewall filter add chain=input protocol=tcp dst-port=22 src-address=!10.0.0.0/24 action=drop
2. Upgrade to RouterOS 6.49.21, 7.23.4, or 7.24.2+ — The vendor patch eliminates the state-machine flaw entirely. Given active exploitation, treat this as an emergency patch cycle — apply within hours to days, not the standard 180-day noisgate remediation SLA for HIGH. Use MikroTik's /system package update install or mass-deploy via The Dude / Ansible. Prioritize internet-facing devices first.
3. Hunt for compromise indicators on all RouterOS devices — Before and after patching, check every device for IoCs: SSH login attempts with username -2, unexpected user accounts (especially ops with full admin policy), new scheduler scripts, unknown tunnels (GRE/IPIP/L2TP), modified firewall or NAT rules, and .rif diagnostic files you did not create. Known attacker IPs: 82.192.72.4, 103.102.31.18. Run /user print, /system scheduler print, /interface print and diff against your known-good config backups. Any device showing IoCs must be treated as fully compromised — rebuild from clean firmware and config.
4. Disable SSH if not operationally required; use WinBox or the API instead — If your management workflow does not depend on SSH, disable the SSH service entirely (/ip service set ssh disabled=yes). WinBox uses a different protocol and is not affected by this CVE. This is a zero-cost mitigation for many deployments. Deploy within hours given active exploitation.
5. Enable RouterOS logging and forward to SIEM — Ensure /system logging is configured to forward auth and system topics to a remote syslog/SIEM. This provides forensic visibility into exploitation attempts and post-compromise activity. Critical for detecting the -2 username pattern and unauthorized account creation.

Run from an auditor workstation with SSH access to the target MikroTik device. Requires ssh client and valid credentials. Usage: bash check_cve_2026_67279.sh 192.168.88.1 admin (optionally append a custom SSH port as a third argument). The script authenticates to the device, retrieves the RouterOS version, and compares it against fixed versions.

#!/bin/bash
# CVE-2026-67279 Check — MikroTik RouterOS SSH Pre-Auth Rekey Bypass
# Usage: bash check_cve_2026_67279.sh <router_ip> <ssh_user> [ssh_port]
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -uo pipefail

TARGET="${1:?Usage: $0 <router_ip> <ssh_user> [ssh_port]}"
USER="${2:?Usage: $0 <router_ip> <ssh_user> [ssh_port]}"
PORT="${3:-22}"

echo "[*] Connecting to ${TARGET}:${PORT} as ${USER}..."
RAW=$(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -o BatchMode=yes \
  -p "$PORT" "${USER}@${TARGET}" \
  ':put [/system resource get version]' 2>/dev/null)
RC=$?
if [ $RC -ne 0 ] || [ -z "$RAW" ]; then
  echo "UNKNOWN — could not retrieve RouterOS version from ${TARGET}:${PORT} (ssh exit code ${RC})"
  exit 2
fi

# Strip channel label, e.g. "7.24.1 (stable)" -> "7.24.1"
VERSION=$(echo "$RAW" | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from output: ${RAW}"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)
PATCH=${PATCH:-0}

echo "[*] Detected RouterOS version: ${VERSION}"

VULN=0
if [ "$MAJOR" -eq 6 ]; then
  if [ "$MINOR" -lt 49 ]; then
    VULN=1
  elif [ "$MINOR" -eq 49 ] && [ "$PATCH" -lt 21 ]; then
    VULN=1
  fi
elif [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -lt 23 ]; then
    VULN=1
  elif [ "$MINOR" -eq 23 ] && [ "$PATCH" -lt 4 ]; then
    VULN=1
  elif [ "$MINOR" -eq 24 ] && [ "$PATCH" -lt 2 ]; then
    VULN=1
  fi
else
  echo "UNKNOWN — unexpected major version ${MAJOR}; manual review required"
  exit 2
fi

# IoC spot-check: look for the '-2' username and 'ops' account
echo "[*] Checking for MikroTrick compromise indicators..."
USERS=$(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -o BatchMode=yes \
  -p "$PORT" "${USER}@${TARGET}" \
  ':put [/user find]' 2>/dev/null || echo "")
if echo "$USERS" | grep -qi 'ops'; then
  echo "[!] WARNING: User 'ops' found — possible MikroTrick compromise indicator!"
fi

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE — RouterOS ${VERSION} is affected by CVE-2026-67279"
  echo "  Remediation: upgrade to 6.49.21 / 7.23.4 / 7.24.2+"
  exit 1
else
  echo "PATCHED — RouterOS ${VERSION} is not affected by CVE-2026-67279"
  exit 0
fi

1. CERT Polska Advisory — Vulnerabilities in MikroTik RouterOS software
2. CISA KEV Alert — CVE-2026-86060 Added September 10, 2026
3. The Hacker News — MikroTrick Chain Analysis
4. Cybernews — MikroTik RouterOS Vulnerabilities Expose 122,500 Routers
5. SecurityWeek — MikroTik Patches Critical Flaws Chained to Hack Routers
6. Hunting MikroTrick: Log Indicators and Forensic Checks
7. SecurityOnline — MikroTrick PoC: RouterOS Admin Rights Exploited in Wild
8. Strix.ai — CVE-2026-67279 CVSS 6.9 Details