Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
- Vendor
- MikroTik
- Product
- RouterOS
- CVSS
- 6.5
- EPSS (exploit probability)
- 2.3%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-67279 being exploited?
Yes. CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 2.3% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-67279 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-67279 is an improper enforcement of behavioral workflow in MikroTik RouterOS’s SSH session handling. An unauthenticated client can open a session channel and send an exec request through the affected code path. This flaw’s significance is in what it enables: chaining into CVE-2026-86060, the CVSS 9.8 argument-handling flaw that allows privilege escalation on the same device. Together, the chain provides unauthenticated access with elevated privileges on affected routers.
CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog on September 25, 2026. The remediation deadline for federal civilian agencies under BOD 26-04 is September 28, 2026. Consult MikroTik’s security advisory page and the NVD record above for the specific patch versions addressing this flaw. Fixed versions for the companion CVE-2026-86060 are RouterOS 6.49.21, 7.23.4 (long-term), and 7.24.2 (stable).
Other MikroTik RouterOS CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 6.4% | |
| CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerabilitywrite-up | [ HIGH ] | 8.2 | 1.6% | |
| CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 65.8% | |
| CVE-2018-14847 MikroTik Router OS Directory Traversal Vulnerability | [ CRITICAL ] | 9.1 | 96.0% |
