Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Mikrotik RouterOS can let attackers log in via SSH

CVE-2026-67276 · published 1 month ago
Summary

The SSH service in RouterOS does not fully verify a user's RSA key, so someone who knows a public key's main part can craft a fake key and gain access without the real private key. This could let an unauthorized person run commands on the router. Update RouterOS to the latest 7.x release (7.23.4 LTS or 7.24.2 stable) to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mikrotik routeros < 7.24.2
>= 7.9, < 7.23.4
>= 7.24, < 7.24.2
Original advisory text
SSH user impersonation possible in Mikrotik RouterOS
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
6% chance of attack within 30 days
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published5 Sep 2026
Updated27 Sep 2026
First seen5 Sep 2026
Sources
CVE-2026-67276 · NVD
CVE-2026-67276 · MITRE
Track software like this
Free during beta