Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the…
Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.
Exploitation probability EPSS · FIRST
Exploitation signals 3 / 5
- KEV catalog (CISA)25 Sept 2026
- Exploited in EUVD (ENISA)25 Sept 2026
- Used by ransomwareno
- EPSS above 10 %2.3%
- No account, over the networkyes
What to do
Fix
Apply the vendor’s fix as soon as it is available.
CISA guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Meanwhile
Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.
Manufacturers (CRA)
Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained
Description ENISA EUVD
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Affected products
- 7.24 <7.24.2
- 6.0.0 <6.49.21
- 7.0.0 <7.23.4
Open source packages OSV
Affected libraries according to OSV, with fixed versions.
Timeline
-
Published
-
Exploitation reported (ENISA)
-
Added to the KEV catalog
-
CISA remediation due date
References
Other exploited vulnerabilities from the same vendor
- CVE-2026-86060MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability5.7 · Actively exploited
- CVE-2026-67277MikroTik RouterOS Missing Authentication for Critical Function Vulnerability5.4 · Actively exploited
- CVE-2026-67276MikroTik RouterOS5.1 · Actively exploited
- CVE-2018-7445MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability8.3 · Background exploitation
- CVE-2018-14847MikroTik Router OS Directory Traversal Vulnerability8.9 · Background exploitation