Skip to content
MikroTik RouterOS Vulnerabilities Enable Pre-Auth SSH Takeover

MikroTik RouterOS Vulnerabilities Enable Pre-Auth SSH Takeover

First seen 27 Sep 2026, 14:22 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 27, 2026 at 18:20 UTC
  • •CVE-2026-67279 and CVE-2026-86060 enable unauthenticated SSH takeover of MikroTik RouterOS.
  • •Active exploitation confirmed with over 122,500 vulnerable instances exposed on the internet.
  • •Tools for exploitation and detection are available, but intended for authorized security research only.

Two critical vulnerabilities, CVE-2026-67279 and CVE-2026-86060, allow unauthenticated SSH takeover of MikroTik RouterOS. CVE-2026-67279 exploits a state-machine flaw permitting rekey requests before authentication, while CVE-2026-86060 allows argument injection to gain full admin access. These vulnerabilities have been actively exploited since September 2, 2026, with over 122,500 internet-exposed instances identified. Tools for exploiting these vulnerabilities include a weaponized script for red teams and a non-intrusive scanner for blue teams, both intended for authorized use only. CISA added CVE-2026-86060 to its KEV catalog on September 10, 2026, highlighting the urgency of addressing these flaws. Users are advised to upgrade to the latest RouterOS versions to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-04
CVE-2026-0073 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-14
CVE-2026-54121 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-28
CVE-2026-82329 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-05
CVE-2026-67279 and CVE-2026-86060 published
Both vulnerabilities were disclosed, revealing critical flaws in MikroTik RouterOS SSH authentication.
Sploitus
2026-09-05
CVE-2026-67276 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-10
CVE-2026-86060 added to CISA KEV catalog
CISA confirmed active exploitation of CVE-2026-86060, urging immediate attention from affected users.
Sploitus
2026-09-25
CVE-2026-67279 added to CISA KEV catalog
CISA acknowledged the active exploitation of CVE-2026-67279, emphasizing the need for urgent patching.
Sploitus
2026-09-26
Public PoC for CVE-2026-67279 released
A proof-of-concept script was made available for CVE-2026-67279, demonstrating the vulnerability's exploitation.
Sploitus
2026-09-27
MikroTrick tools released
New tools for exploiting and detecting the MikroTrick vulnerabilities were published, aimed at authorized security research.
Sploitus

More articles in this cluster (2)

Following this threat?

Track CVE-2026-0073 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2