CVE-2026-67278

criticalpriority · track · 36EPSS 0.003 · 18 %ileDERUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (18th) EPSS

CVSS 9.1 · critical

Is it mine?

12 products

Check your exposure

Who says so?

3 sources

fstec_bdu · cert_bund · nvd

EPSS · scored 2026-10-27

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 1.7–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.17.2highAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cvd@cert.pl

v4.01.7lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347US

affected products (12)

Products and version ranges known to be affected.

MikroTik RouterOS <6.49.21all versionscert_bundDE
MikroTik RouterOS <7.23.4all versionscert_bundDE
MikroTik RouterOS <7.24.2all versionscert_bundDE
MikroTik RouterOS <7.25 beta 3all versionscert_bundDE
MikroTik RouterOS< 6.49.21cert_bundDE
MikroTik RouterOS< 7.23.4cert_bundDE
MikroTik RouterOS< 7.24.2cert_bundDE
MikroTik RouterOS< 7.25 beta 3cert_bundDE
MikroTik RouterOS7.0.0 → 7.23.4fstec_bduRU
MikroTik RouterOS7.24.0 → 7.24.2fstec_bduRU
mikrotik routeros7.0 → 7.23.6nvdUScpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
mikrotik routeros7.24 → 7.24.3nvdUScpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3193MikroTik RouterOS: Mehrere SchwachstellenDeutsch2026-09-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MikroTik RouterOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um einen Denial of Service Zustand herbeizuführen und um die Kontrolle über betroffene Geräte zu übernehmen.

also known as (1)

Other names and identifiers for this entity.

BDU:2026-14786 fstec_bdu

sources

Which sources assert this record, and when.

fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2026-09-05modified 2026-09-28

references (6) nvd

External citations — patches, advisories, analysis.

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/MitigationThird Party Advisory
https://forum.mikrotik.com/t/7-23-6-long-term-is-released/273139Release Notes
https://forum.mikrotik.com/t/7-24-3-stable-is-released/273138Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ExploitThird Party Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan