CVE-2026-67277

Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation

Polish CERT disclosed three vulnerabilities in MikroTik routers, two of which have been actively exploited since at least September 2. The flaws, rated 9.2 on CVSS, affect devices with internet-facing SSH access and were discovered using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol followed by manual verification. CVE-2026-67276 allows authentication bypass when the attacker knows the username and public key module, while CVE-2026-86060 permits privilege escalation via usernames containing invalid characters. Their combination enables full device compromise. A third issue, CVE-2026-67277 rated 8.8, resides in the speed-test service and can cause denial of service. Patches are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, and MikroTik added detection for prior compromise. Attacks began concurrently with patch release and leave distinctive log entries.

CISA Adds MikroTik RouterOS Flaws CVE-2026-67277 and CVE-2026-86060 to Known Exploited Vulnerabilities Catalog

The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities Catalog. CVE-2026-86060 stems from improper sanitization of command argument delimiters and can lead to privilege escalation after an attacker gains access to the SSH login helper and alters trusted policy masks. CVE-2026-67277 involves missing authentication checks in critical RouterOS functions, allowing connections before authentication completes and potentially leaking kernel memory or causing denial-of-service conditions. CISA directed US federal agencies to apply mitigations by September 13 and specifically investigate any signs of compromise related to CVE-2026-86060. The agency noted that the flaws carry broader exploitation risk and urged all organizations using affected MikroTik products to take immediate action.