MikroTik RouterOS CVE-2026-67279

SSH service must be enabled and network-reachable on the target RouterOS device; SSH is enabled by default in RouterOS and is commonly exposed on management or WAN interfaces. No credentials, no prior session, no non-default configuration, and no user interaction are required - the bypass is triggered purely by the standard SSH rekey message sequence before authentication completes. Exploitation is bounded by the RouterOS managed file namespace (the /files/ virtual directory and support file generation facilities) and does not provide access to the underlying Linux shell or raw OS filesystem. Only RouterOS versions prior to 6.49.21, 7.23.4 (Long-term), and 7.24.2 (Stable) are vulnerable; devices on up-to-date firmware in any channel are unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, unauthenticated, zero-complexity exploitation with no required network positioning or user interaction. The vendor-rated score of 6.9 with VC:L/VI:L/VA:N reflects that impact is scoped to the RouterOS managed file namespace rather than full OS shell access; however, RouterOS support output files (supout.rif) are comprehensive diagnostic exports that include interface configurations, routing tables, firewall ruleset dumps, VPN parameters, and potentially credential-adjacent data, suggesting real-world confidentiality impact may exceed the vendor's L rating. A publicly available PoC exists alongside a detailed reverse-engineering writeup of the silent patch at npratley.net, significantly lowering exploitation complexity. CERT-PL published dedicated research and a second post explicitly framing MikroTik RouterOS vulnerabilities as actively exploited - while not yet confirmed in CISA KEV, this is a credible threat signal. MikroTik's large ISP, SMB, and home-network install base, combined with SSH commonly exposed on management or WAN interfaces, creates a realistic mass-exploitation surface for automated scanning campaigns.

An attacker scans for RouterOS devices with SSH exposed on TCP/22, connects with a modified SSH client, completes the initial key exchange, then immediately sends SSH_MSG_KEXINIT to initiate a client-requested rekey before any authentication exchange occurs. The RouterOS server erroneously transitions to the connection protocol state, whereupon the attacker opens a session channel, sends exec requests to enumerate and download files from the managed namespace, and exfiltrates support output bundles containing configuration and diagnostic data without any valid credentials. A public PoC exists and the patch logic has been reverse-engineered and documented, enabling scripted, automated exploitation at scale.