DEV Community

StarkMan
StarkMan

Posted on

Why CVE-2026-67277 Reached the CISA KEV Catalog So Fast

#security #vulnerability #mikrotik #routeros

Why CVE-2026-67277 Reached the CISA KEV Catalog So Fast

A vulnerability that is disclosed and a vulnerability that is exploited are different events, and the gap between them has been shrinking for years. CVE-2026-67277 in MikroTik RouterOS is a case study in how short that gap can be. Exploitation was observed on 2026-09-02, CERT Polska published on 2026-09-05, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-10. This article looks at what that timeline means and what the KEV listing obliges.

The vulnerability in brief

CVE-2026-67277 is a CWE-306 missing-authentication flaw in MikroTik RouterOS, exposed through the SSH management service. It is the first half of the MikroTrick chain; the second half is CVE-2026-86060, a CWE-88 argument-delimiter neutralization flaw. Chained, they let an unauthenticated attacker with network reach to SSH take full administrative control of the device. Public reporting places the severity around 9.2, and CISA treats it as critical.

Reading the timeline

Three dates tell the story.

  • 2026-09-02. CERT Polska observes exploitation in the wild. The attacks are not theoretical; they are happening against real, internet-exposed devices.
  • 2026-09-05. CERT Polska publishes its advisory, warning that MikroTik RouterOS devices with SSH exposed to the internet should be treated as compromised until proven otherwise. MikroTik's fixes are available around this time in RouterOS 6.49.21, 7.23.4, and 7.24.2.
  • 2026-09-10. CISA adds CVE-2026-67277 to the KEV catalog, confirming evidence of active exploitation and triggering federal remediation deadlines.

The compression here is the point. There was no long period of quiet research before attackers arrived. Detection and exploitation overlapped, and the defensive window was measured in days.

What KEV listing actually changes

The KEV catalog is not a severity ranking. It is a list of vulnerabilities with confirmed evidence of exploitation in the wild. Inclusion carries obligations for US federal civilian executive branch agencies under Binding Operational Directive 26-04, which prioritizes remediation of high-risk vulnerabilities on publicly exposed assets and sets expectations for checking whether a system was compromised before patching.

For organizations outside the federal scope, the practical signal is simpler: a KEV entry means someone is already using this, so the question shifts from whether to patch to how quickly and in what order.

The edge-device pattern

CVE-2026-67277 fits a pattern that has repeated across network edge devices. The target is a long-lived appliance that sits on the boundary between trusted and untrusted networks, is rarely updated, and is often managed through an interface that someone exposed to the internet for convenience. The vulnerability class, missing authentication on a critical function, is about as direct as a flaw gets: the check that should stop an attacker is not performed.

That combination, a forgotten device plus a missing check plus an exposed management port, is what turns a routine advisory into an active incident.

Exposure context

ZoomEye's app="RouterOS" query returned 2,854,024 matching assets on 2026-09-16. This is the fingerprint-matched population, not a count of vulnerable or exposed devices, but it illustrates the scale of the scanning surface. The CVE-specific query vul.cve="CVE-2026-67277" returned zero indexed assets at the same time, which is expected for a recent disclosure and does not undercut the product-level figure.

What to do

Upgrade to RouterOS 6.49.21, 7.23.4, or 7.24.2, matching your branch. Then treat the upgrade as the beginning of remediation rather than the end. Because exploitation predates the advisory, any device that had SSH exposed to the internet during the window should be checked for the reported indicators: SSH log entries for the username -2, an unexpected privileged account named ops, unfamiliar scheduled scripts, and connections to the reported source addresses 82.192.72.4 and 103.102.31.18. Recent RouterOS builds also run a startup integrity check that flags known tampering.

Where compromise is confirmed, rebuild rather than repair. Administrator-level access means the attacker could have left persistence that a firmware update will not remove.

References

Top comments (0)