Vulnerability Intelligence Report
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
CVE-2026-67279
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
CISA KEV
SSVC: Active Exploitation
Automatable
CVSS Base Score
6.9
MEDIUM
EPSS Probability:0.71%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-841 ↗CWE-841 Improper enforcement of behavioral workflow
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Mikrotik | RouterOS | 7.24 < 7.24.2 (affected), 7.0.0 < 7.23.4 (affected), 6.0.0 < 6.49.21 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | CERT.PL · CERT · Poland |
| Reserved | 2026-07-29T11:59:30 |
| Published | 2026-09-05T20:00:57 |
| Last Updated | 2026-09-25T15:41:23 |
Community Chatter & Buzz