Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
- Vendor
- MikroTik
- Product
- RouterOS
- CVSS
- 6.5
- EPSS (exploit probability)
- 1.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
CVE-2026-67279 is an improper enforcement of behavioral workflow in MikroTik RouterOS’s SSH session handling. An unauthenticated client can open a session channel and send an exec request through the affected code path. This flaw’s significance is in what it enables: chaining into CVE-2026-86060, the CVSS 9.8 argument-handling flaw that allows privilege escalation on the same device. Together, the chain provides unauthenticated access with elevated privileges on affected routers.
CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog on September 25, 2026. The remediation deadline for federal civilian agencies under BOD 26-04 is September 28, 2026. Consult MikroTik’s security advisory page and the NVD record above for the specific patch versions addressing this flaw. Fixed versions for the companion CVE-2026-86060 are RouterOS 6.49.21, 7.23.4 (long-term), and 7.24.2 (stable).
