SB2026090616 - Multiple vulnerabilities in MikroTik RouterOS

Description

This security bulletin contains information about 6 vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-67276) Exploited

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to open an SSH command channel as an authorized user.

The vulnerability exists due to improper verification of cryptographic signatures in the RouterOS SSH authorized-key matching logic when processing SSH authentication requests. A remote attacker can supply an RSA public key using an authorized modulus and an exponent of one to open an SSH command channel as an authorized user.

Note, the vulnerability is being actively exploited in the wild.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2026-67277)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory and cause a denial of service.

The vulnerability exists due to missing authentication for a critical function in the RouterOS btest connection handling when accepting a related btest connection before primary-session authentication completes. A remote attacker can start an IPv4 UDP test with random-data disabled and use the unchecked packet-size interval to disclose kernel memory and cause a denial of service.

3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-67278)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate TLS servers.

The vulnerability exists due to improper verification of cryptographic signatures in the RouterOS X.509 validation logic when validating malformed RSA/PKCS#1 v1.5 signatures. A remote attacker can forge a trusted intermediate certificate for arbitrary hostnames to impersonate TLS servers.

Exploitation requires control of or the ability to redirect an outbound RouterOS TLS connection and relies on the trusted e=3 root CA.

4) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-67279)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access and modify files in the RouterOS managed file namespace.

The vulnerability exists due to improper enforcement of behavioral workflow in the RouterOS SSH connection protocol when handling a client-requested rekey before user authentication. A remote attacker can open a session channel and send an exec request to access and modify files in the RouterOS managed file namespace.

The accessible files can include support files containing configuration and diagnostic data.

5) Access of Uninitialized Pointer (CVE-ID: CVE-2026-67281)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose root-owned files.

The vulnerability exists due to access of an uninitialized pointer in the RouterOS WebFig /jsproxy file authorization path when handling crafted encrypted URIs. A remote attacker can prepare the allocator and supply parent-directory components in an encrypted URI to disclose root-owned files.

The stale principal pointer can be dereferenced with sufficient rights to escape the WebFig file namespace.

6) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-86060)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper neutralization of argument delimiters in the RouterOS SSH login path when processing a username beginning with a prohibited character. A remote attacker can submit a crafted username to change the trusted RouterOS policy mask and escalate privileges.

Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.

Remediation

Install update from vendor's website.

References

• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://mikrotik.com/supportsec/september-2026-vulnerability/