Skip to content
OpenAdvisories
Medium · 6.9 Known exploited Public exploit CVE-2026-67279 EUVD-2026-72027GHSA-pqp3-gjgf-83cf

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

Published Sep 5, 2026 · Updated Sep 26, 2026 · Assigned by CERT-PL

Vendor: MikroTik Product: RouterOS Category: Network devices

Description

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Affected products

VendorProductAffectedFixed
Mikrotik RouterOS 7.24 – < 7.24.2, 7.0.0 – < 7.23.4, 6.0.0 – < 6.49.21 7.24.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed sshamble 0.3.12-1.1 openSUSE-SU-2026:11737-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • tc4dy/CVE-2026-67279-86060-Toolkit ★ 10 · Sep 27, 2026

    CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, …

  • HackSpeak/CVE-2026-67279 ★ 5 · Sep 26, 2026

    MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing

  • shmaki4/CVE-2026-67279-Mikrotik-6.42-POC ★ 1 · Oct 8, 2026

    Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42.

  • GoldAden/mikrotrick-verifier ★ 0 · Oct 17, 2026

    Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References