CVE-2026-67276 json
SSH user impersonation possible in Mikrotik RouterOS
published 2026-09-05 2 mo ago modified 2026-09-25 44 d ago also EUVD-2026-72024
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.9%
- EPSS 8.9% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
Patch / fix
- Mikrotik RouterOS 7.23.4, 7.24.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
8.94% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- npratley.net https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Mikrotik RouterOS
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
npratley.net
/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
exploit, third-party-advisory
-
mikrotik.com
/supportsec/september-2026-vulnerability/
vendor-advisory
-
cert.pl
/en/posts/2026/09/mikrotik-routeros-cve
third-party-advisory
-
cert.pl
/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
technical-description, mitigation, third-party-advisory
-
forum.mikrotik.com
/t/7-23-4-long-term-is-released/272801
release-notes
-
forum.mikrotik.com
/t/7-24-2-stable-is-released/272800
release-notes
Sources
- CVE List CVE-2026-67276
- NVD CVE-2026-67276
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.