CISA Adds MikroTik RouterOS SSH Bypass to KEV
Tech GuruQuick Answer
The RouterOS SSH bypass tracked as CVE-2026-67279 is listed in CISA KEV. Restrict SSH management to trusted paths and update the affected RouterOS branch. Review the router's security status and configuration as well: patching is not a substitute for checking an appliance that may already have been accessed.
Confirm Scope And Apply The Supported Fix
Next step: Confirm the installed RouterOS branch and vendor-listed fix, preserve relevant evidence, and restrict untrusted SSH access without locking out your recovery path. Check every managed router, not just the Internet gateway.
Last verified: 2026-09-26 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | MikroTik RouterOS 6.x and 7.x releases in the CERT Polska CNA record |
|---|---|
| Advisory | CISA KEV: CVE-2026-67279 |
| CVE | CVE-2026-67279 |
| Authoritative release date | 2026-09-25 14:39:25.365400 UTC |
| Authority revision date | 2026-09-25 15:41:23.920 UTC |
| Affected versions | RouterOS 6.0.0 before 6.49.21, 7.0.0 before 7.23.4, and the 7.24 branch before 7.24.2; the CNA record marks other versions unaffected by default. |
| Fixed version | RouterOS 6.49.21, 7.23.4, or 7.24.2 and later supported releases as applicable |
| CVSS base score | 6.9 (official CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | CISA lists exploitation in the wild for this CVE. The recorded ransomware-use field is Unknown; neither field establishes the state of an individual router. |
What Changed
The vendor's response includes upgrading, reviewing Flagged status, and looking for unexpected configuration changes. A clean indicator alone is not proof of an uncompromised device. KEV's recorded federal deadline has a specific organizational scope; the known-exploitation signal still matters to other operators.
What To Validate Now
- Inventory. Locate MikroTik RouterOS 6.x and 7.x releases in the CERT Polska CNA record deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: RouterOS 6.0.0 before 6.49.21, 7.0.0 before 7.23.4, and the 7.24 branch before 7.24.2; the CNA record marks other versions unaffected by default. Do not infer applicability from product family or severity alone.
- Remediate. Apply RouterOS 6.49.21, 7.23.4, or 7.24.2 and later supported releases as applicable through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Verify the running version, allowed management sources, administrator accounts, routing, DNS, firewall rules, and scheduled tasks against a trusted baseline. Test legitimate management and traffic after the change. Escalate unexplained differences before restoring routine remote access.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
