CVE-2026-67276: fallo crítico en Mikrotik RouterOS
SSH user impersonation possible in Mikrotik RouterOS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
75Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck, tiene alerta oficial del gobierno de Brasil y tiene prueba de concepto pública.
ssvc Actcvss 9.2epss 8.9%
de la publicación al arma1 día
Publicada en NVD5 sept
1ª PoC+1d
VulnCheck5 sept
Alerta oficial en Brasil
El gobierno federal de Brasil publicó una alerta, recomendación o boletín que cita esta vulnerabilidad.
- CISC Gov.br · 09 sep 2026Boletim do CISC de Vulnerabilidadesleer en gov.br ↗
Fuente: CTIR Gov (GSI) y CISC Gov.br, bajo licencia CC BY-ND 3.0.
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Mikrotik · RouterOSPoCs públicas encontradas — 10
githubgithub.com/dinosn/mikrotrick-poc★ 102githubgithub.com/BlackHatExploitation/exploit-mikrotik-2026★ 14githubgithub.com/4rt-Net/Mikrotrick_POC★ 2githubgithub.com/HORKimhab/CVE-2026-67276★ 1vulncheckvulncheck.com/xdb/a6d3d0e78235no verificadocve_referencenpratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/no verificadovulncheckvulncheck.com/xdb/198acb5bb0b5no verificadovulncheckvulncheck.com/xdb/1d3caaa6186cno verificadovulncheckvulncheck.com/xdb/03b9f37c1966no verificadovulncheckvulncheck.com/xdb/bcce7871500ano verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Mikrotik RouterOS
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-86060CRITICALSSH session privilege manipulation via a crafted username in Mikrotik RouterOSEPSS 6.4%KEVCVE-2026-67279MEDIUMSSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSEPSS 2.3%KEVCVE-2026-67277HIGHKernel memory disclosure and denial of service in MikroTik RouterOS btest serviceEPSS 1.6%KEVCVE-2026-67281HIGHUnauthenticated file read in Mikrotik RouterOSEPSS 0.7%CVE-2023-32154HIGHMikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-6443HIGHMikrotik RouterOS VXLAN Source IP Improper Access Control VulnerabilityEPSS 0.6%
Referencias
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cvehttps://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800https://mikrotik.com/supportsec/september-2026-vulnerability/https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/