MikroTik RouterOS SSH Authentication Bypass and File Manipulation (CVE-2026-67279)
Executive & SecOps Summary
SECOPS ASSESSMENTMikroTik RouterOS versions 6.x and 7.x prior to specific security releases.
Unauthenticated attackers can create, overwrite, or reconstruct files within the RouterOS namespace via SSH, leading to configuration theft or system compromise.
Upgrade to versions 6.49.21, 7.23.4, 7.24.2 or later, and restrict SSH access.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDImmediate firmware upgrade is the primary remediation path.
1. Firmware Update
Update to the following versions via /system package update:
- v6.49.21 (Long-term)
- v7.23.4 (Long-term)
- v7.24.2 (Stable)
2. Temporary Mitigation
If immediate patching is not possible, disable the SSH service or restrict access using firewall rules or service settings.
# Disable SSH service
/ip service set ssh disabled=yes
# Restrict SSH access to trusted management subnet
/ip service set ssh address=10.0.0.0/24Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
This vulnerability arises from an improper enforcement of behavioral workflow (CWE-841) in the RouterOS SSH server. An unauthenticated client can trigger a rekey request and subsequently enter the connection protocol without ever attempting user authentication. Once in this state, the server incorrectly dispatches 'exec' requests, allowing the attacker to perform file operations within the RouterOS managed file namespace. This includes the ability to create or overwrite sensitive configuration and diagnostic files. Given its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog and a high EPSS score of 0.94, this flaw is being actively weaponized in the wild to compromise network infrastructure.
Official Vendor Advisories & References
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.