CVE-2026-67276

Executive Summary

CVE-2026-67276 is a critical authentication bypass vulnerability in MikroTik RouterOS affecting the SSH public-key authentication mechanism. The flaw exists because RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key — it checks the key type and modulus but omits the exponent. An attacker who knows an authorized RSA modulus can supply a key with exponent one (e=1), forge a valid signature, and open an SSH command channel as the target user without possessing the corresponding private key. Fixed versions are 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable); however, patch confidence is rated 0/4, indicating no verifiable patch evidence from tracked sources at this time. Successful exploitation grants full administrative control over network infrastructure devices (routers, switches, wireless access points) running RouterOS.

Technical Analysis

The vulnerability resides in the SSH server implementation of MikroTik RouterOS, specifically within the RSA public-key authentication mechanism. RSA public keys consist of three components: modulus (n), public exponent (e), and private exponent (d, kept secret). When a client attempts SSH authentication via public key, it presents a public key and signs a challenge with the corresponding private key. The server verifies the signature using the presented public key and checks whether that key matches an authorized key for the target user.

The critical flaw is that RouterOS's key-matching logic compares only the modulus component (n) between the presented key and the authorized key, omitting the comparison of the public exponent (e). This is a fundamental flaw in the authentication decision process — the server is checking "is this modulus authorized?" rather than "is this exact key authorized?"

The attack exploits a mathematical property of RSA: when the public exponent is set to 1 (e=1), the signature verification equation simplifies dramatically. In RSA, signature verification checks whether s^e ≡ m (mod n), where s is the signature, e is the public exponent, m is the message, and n is the modulus. When e=1, this becomes s ≡ m (mod n) — meaning ANY value that equals the message modulo n is a valid signature. More practically, an attacker can craft a "signature" that satisfies this trivial equation without needing the private key, because the verification degenerates to a simple congruence check.

Since the victim's authorized public key modulus (n) is derived from the real authorized key, an attacker knowing the authorized modulus can:

1. Construct a rogue public key using the victim's modulus (n) with exponent e=1.
2. Present this key during SSH authentication.
3. Because RouterOS matches only on modulus, the key is accepted as matching the authorized user.
4. The bogus signature (trivially constructed for e=1) passes verification.

The attack surface is the SSH command channel (port 22) exposed on RouterOS devices. The prerequisite is knowledge of an authorized RSA modulus, which in many deployments is derivable from publicly accessible information (e.g., a user's public key published on a website, or leaked configuration files). This attack completely bypasses the need for the private key.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Step 1: Reconnaissance/Target Identification An attacker scans for internet-exposed MikroTik devices (Shodan: product:"MikroTik RouterOS") running vulnerable RouterOS versions. The SSH service (port 22) must be enabled. The attacker also identifies a target username with an authorized RSA key — common in MikroTik deployments where SSH keys are used for automated management. The authorized modulus may be obtained from OSINT (published configs, leaked admin documentation) or from a prior low-severity compromise of a config backup.

Step 2: Triggering the Flaw The attacker initiates an SSH connection to the target device, specifying the victim's username. During the public-key authentication phase, the attacker presents a crafted RSA public key containing the victim's known modulus (n) but with public exponent set to e=1. RouterOS's key-matching logic compares only the modulus (n) and determines the key is authorized, proceeding to signature verification.

Step 3: Payload/Execution Method (Vulnerability-Class Level) The attacker sends a challenge-response signature that exploits the e=1 property. Since RSA verification with e=1 degenerates to checking s ≡ m (mod n), the attacker constructs a signature value trivially satisfying this condition without any private-key computation. The degenerate mathematical property means the attacker can forge a valid signature for any challenge message. RouterOS accepts the forged signature and opens an SSH command channel as the target user.

Step 4: Post-Exploitation Impact The attacker now has an authenticated SSH session as the authorized user. If the user has administrative privileges (common for RouterOS management keys), the attacker gains full control of the device: can modify firewall rules, intercept and reroute network traffic, install persistent backdoors, exfiltrate VPN credentials, pivot into the internal network, or disrupt service (DoS). If the user is non-privileged, the attacker may still enumerate network topology and credentials, or escalate through other vulnerabilities.

Impact Assessment

Business Impact: Critical — full authentication bypass. This vulnerability allows an attacker to completely bypass SSH RSA public-key authentication, which is often the primary secure management channel for MikroTik devices. Successful exploitation provides:

• Complete administrative control of network infrastructure devices
• Ability to intercept, modify, or redirect all network traffic transiting the device
• Persistence through configuration backdoors (e.g., rogue users, hidden scheduler jobs)
• Lateral movement into internal networks through VPN termination points

Affected Systems: MikroTik RouterOS versions prior to 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). This includes:

• Routers (RB series, CCR series)
• Wireless access points (hAP series, wAP series)
• Switches (CRS series)
• CHR (Cloud Hosted Router) instances
• Any device running RouterOS with SSH public-key authentication enabled and at least one authorized RSA key

Blast Radius: MikroTik devices are extensively deployed in small-to-mid businesses, ISPs, hotels, and managed service providers globally; recent estimates suggest hundreds of thousands of internet-exposed RouterOS instances. A successful exploit chain targeting multiple devices could enable large-scale network infrastructure compromise, similar in magnitude to the 2018 VPNFilter and the 2019 CVE-2019-13951 attacks.

Severity Rationale: While CVSS score is listed as N/A in source data, an inferred vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H reflects that the attack requires network access (low barrier) but knowledge of an authorized modulus (increasing complexity). The scope is changed (S:C) because compromise of a network device can impact systems beyond the device itself. If exploited, the confidentiality, integrity, and availability impacts are all High.

Detection Guidance

Detection of this specific vulnerability is challenging because the attack is cryptographically indistinguishable from legitimate SSH authentication at the protocol level — the dialog succeeds with valid-looking credentials. The distinguishing factors are: exponent value of e=1 in the key, and the authentication event itself for a user whose real key uses a different exponent.

Sigma Rule

title: MikroTik RouterOS SSH RSA Key Exponent Bypass Authentication
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSH authentication attempts using RSA keys with exponent of 1, which indicates a possible CVE-2026-67276 exploitation attempt
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-67276
author: Valters IT Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1190
    - attack.initial_access
logsource:
    product: mikrotik
    service: ssh
detection:
    selection:
        EventID: 'SSH Authentication'
        AuthMethod: 'publickey'
        KeyType: 'ssh-rsa'
        Exponent: 1
    condition: selection
level: critical
falsepositives:
    - Extremely rare - RSA public keys with exponent 1 are mathematically insecure and should never be legitimately deployed

YARA Rule

rule MikroTik_RouterOS_RSA_Key_Exponent_Bypass_CVE_2026_67276 {
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects SSH banners or configuration artifacts associated with MikroTik RouterOS vulnerable SSH key handling"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67276"
        date = "2026-01-15"
        version = "1.0"
    strings:
        $ssh_banner_mikrotik = "SSH-2.0-6.4" ascii nocase
        $ssh_banner_mikrotik2 = "SSH-2.0-7.2" ascii nocase
        $ssh_key_exponent_test = "e=1" ascii nocase // Simplified - actual key format varies
    condition:
        uint16(0) == 0x3A50 or any of ($ssh_banner_mikrotik*) or $ssh_key_exponent_test
}

Note: YARA is more suited to static file analysis. Given the attacker supplies the key over the network, generating a robust detection YARA rule requires payload capture. The above is a heuristic. For SSH public keys, DER-encoded exponent of value 01 is a stronger indicator.

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"MikroTik RouterOS RSA SSH Key Exponent Bypass Attempt (CVE-2026-67276)"; flow:established,to_server; content:"ssh-rsa"; nocase; pcre:"/(?:06 03 55 04 03|0d 03 55 04 03|^.{20,}|.*)(?:02 01 01)/"; offset:4; depth:200; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:10000001; rev:1; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-67276;)

Elastic Detection

any where process.name == "sshd" and event.action in ("authentication_success", "authentication_failure") and 
  (message like "*publickey*" or message like "*ssh-rsa*") and 
  (message like "*exponent: 1*" or message like "*e=1*" or message like "*public key exponent 1*")

Splunk SPL Query

index=network sourcetype=linux_secure OR sourcetype=ssh_logs
| where (src_user!="" OR user!="") 
| regex _raw="(?i)(publickey|ssh-rsa)"
| regex _raw="(?i)(exponent.?[:=].?1\b|e=.?1\b)"
| stats count min(_time) as earliest max(_time) as latest by src_ip, dest_ip, user, host
| table earliest latest src_ip dest_ip user host count
| sort - latest

Wazuh OSSEC Rule

<rule id="100101" level="12">
    <decoded>ssh</decoded>
    <description>MikroTik RouterOS SSH authentication success with RSA key exponent 1 - potential CVE-2026-67276 exploitation</description>
    <group>authentication,failed_authentication,sshd,pci_dss_10.2.4,</group>
    <regex>Accepted publickey for .*? ssh-rsa .*?\x01</regex>
    <field name="exponent">1</field>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Status: Patch confidence 0/4 — UNPATCHED. No patch evidence from tracked sources. The vendor advisory was not formally tracked by intelligence feeds, meaning MITRE-affiliated sources have not independently confirmed the patch. Treat as actively vulnerable.

Immediate Mitigations (compile ASAP):

1. Disable SSH public-key authentication and require password + TOTP-based authentication instead. Update all automation to use alternative auth methods.
2. Restrict SSH access to only trusted administrative IP ranges via firewall rules: /ip firewall filter add chain=input protocol=tcp dst-port=22 src-address-list=Admin_IPs action=accept / /ip firewall filter add chain=input protocol=tcp dst-port=22 action=drop.
3. Change ALL authorized user keys — this invalidates any captured modules. Also rotate any other secrets that may have been exposed via prior compromise.
4. Disable SSH on WAN interfaces entirely if remote management is not essential; use VPN (L2TP/IPsec or WireGuard) for out-of-band management.

Upgrade Path:

1. Correct the patch tracking gap: Contact MikroTik support or check the official download page (download.mikrotik.com) for RouterOS 6.49.21, 7.23.4, or 7.24.2. Verify the checksum of the downloaded image against MikroTik's published checksums.
2. Upgrade immediately via /system package update install or via WinBox/system upload. Schedule maintenance window.
3. After upgrading, run /system resource print to check running version (should read 7.24.2, 6.49.21, or 7.23.4+).
4. Re-apply security baseline configurations after upgrade.

Long-Term Hardening:

1. Never use RSA keys with common moduli — even if patched, the mathematical weakness suggests key uniqueness matters. Migrate to ed25519 keys.
2. Implement centralized logging (syslog to SIEM) of all authentication events.
3. Enforce exclusive use of non-RSA algorithms: /ip ssh set strong-crypto=yes.
4. Implement a defence-in-depth strategy with IDS/IPS at the network perimeter.
5. Maintain an asset inventory of all RouterOS devices; monitor vendor mailing list for future advisories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-67276
2. MikroTik Download Page (for fixed versions): https://mikrotik.com/download (versions 6.49.21, 7.23.4, 7.24.2)
3. Mitre ATT&CK Initial Access Tactic: https://attack.mitre.org/tactics/TA0001/
4. CWE-347: https://cwe.mitre.org/data/definitions/347.html
5. CISA KEV Catalog: https://cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-67276 is not present in KEV; no evidence of in-the-wild exploitation yet.

Threat Actor Campaign Notes: As of this report, no specific threat actor campaigns have been publicly attributed to this CVE. The vulnerability class is highly attractive to criminal botnet operators (e.g., those who built the Mirai variant exploiting CVE-2023-30799) and state-sponsored actors targeting infrastructure. Network operators should expect scan-and-exploit activity to increase once the patch-version gap widens, and honeypots may capture attacks using exponent-one crafted keys. Monitor MikroTik forums and the "RouterOS Security" mailing list for any emerging exploit reports.