DEV Community

kozhevniko
kozhevniko

Posted on

Inside the MikroTik September 2026 Release: Three RouterOS Flaws, One Patch Cycle

#security #mikrotik #routeros #ssh

Inside the MikroTik September 2026 Release: Three RouterOS Flaws, One Patch Cycle

MikroTik's September 2026 security release, relayed by CERT-In as CRITICAL note CIVN-2026-0460, bundles three distinct RouterOS vulnerabilities. Read together, they describe an attack surface that starts before login and continues after it.

CVE-2026-67276: authentication bypass over SSH

The headline flaw is an incomplete verification of RSA public keys during SSH authentication. An attacker sends a specially crafted SSH public-key authentication request containing a forged RSA key and signature. Because the verification is incomplete, the login succeeds without valid credentials, and the attacker potentially gains full administrative control. No authenticated account is required; only network reachability to the SSH service on an affected device.

CVE-2026-86060: privilege escalation after login

A second SSH-related flaw concerns the handling and neutralization of argument delimiters in the login path. By sending a crafted username or command argument through an accessible SSH login session, an attacker can alter the RouterOS policy mask and escalate privileges, then use the compromised router to reach internal systems. Where CVE-2026-67276 opens the door, CVE-2026-86060 widens what can be done after entry.

CVE-2026-67277: denial of service through btest

The third flaw lives in the bandwidth-test (btest) service, which lacks an authentication check. Crafted network requests to an exposed btest service can read portions of uninitialized kernel memory and crash or restart the router.

Affected versions

  • 7.24 and prior to 7.24.2
  • 7.0.0 and prior to 7.23.4
  • 6.0.0 and prior to 6.49.21

Remediation

Apply the fixed releases referenced in MikroTik's September 2026 advisory. Until every router is patched, limit SSH to trusted sources, disable btest where it is not required, and monitor for unexpected administrative logins.

Sources

Top comments (0)