CVE-2026-67279

Executive Summary

CVE-2026-67279 is a critical authentication bypass vulnerability in MikroTik RouterOS affecting the SSH service. The flaw allows an unauthenticated remote attacker to perform an SSH rekey operation before authentication is completed, causing the server to incorrectly assume authentication has succeeded and enter the connection protocol phase. This enables the attacker to open a session channel, send exec requests, and execute commands on the router without valid credentials, leading to unauthorized file creation, overwrite, and reconstruction in the managed file namespace — including configuration and diagnostic support files. Affected builds include RouterOS versions prior to 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). The vulnerability exposes network edge devices to full compromise, potentially enabling persistent backdoor installation, configuration tampering, and network traffic interception.

Technical Analysis

The vulnerability resides in the SSH protocol state machine implementation within RouterOS. The flaw is categorized under CWE-841, which describes improper handling of state transitions during protocol operations — specifically, the server fails to properly enforce the authentication-required state before processing post-authentication protocol messages.

Vulnerability Mechanism: The SSH protocol (RFC 4253) defines a sequence of states: version exchange, key exchange, user authentication, and connection protocol. After a successful key exchange, a client may request a rekey operation. In standard SSH implementations, rekey operations may only occur after authentication has been completed. In the vulnerable RouterOS builds, the server fails to enforce this ordering constraint.

When an unauthenticated client sends a rekey request (SSH_MSG_KEXINIT) prior to any authentication attempt, the RouterOS SSH server incorrectly transitions into the connection protocol state (RFC 4254) as though the user had already been authenticated. The server then accepts channel-open requests (SSH_MSG_CHANNEL_OPEN) from the unauthenticated client.

State Machine Flaw: The core issue is a failure to validate the authenticated flag before dispatching connection-protocol messages. Once the server erroneously enters the connection protocol, the attacker can:

1. Open a session channel using session channel type.
2. Send a request with exec request type.
3. The server dispatches the command to the underlying shell or command dispatcher without any authentication check.

Because the server dispatches arbitrary commands, the attacker gains the ability to manipulate the RouterOS file namespace. This includes creating new files, overwriting existing ones, and reconstructing support files that contain configuration and diagnostic data. Notably, the attack vector allows manipulation of system-adjacent files, which could be leveraged to inject malicious configuration, escalate privileges, or establish persistence mechanisms.

Attack Surface: The SSH service (typically port 22, or alternative ports if reconfigured) is the sole attack surface. This service is commonly exposed on internet-facing MikroTik routers, particularly those used in enterprise edge deployments, small office/home office (SOHO) environments, and managed service provider infrastructures.

Technical Detail Availability: Insufficient technical detail is available regarding the exact code path or function names involved, as no vendor advisory or researcher publication has been released at the time of this report. The analysis above is inferred from the NVD description and the SSH protocol specification.

Exploitation Scenarios

No public proof-of-concept or exploit code has been disclosed, and no in-the-wild exploitation campaigns have been reported to CISA. The following attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker would scan for internet-facing MikroTik devices exposing the SSH service. This can be performed using mass scanning tools with Shodan queries such as product:"RouterOS" port:22, or by using banner grabbing to identify RouterOS SSH banners (e.g., "SSH-2.0-ROS"). The attacker filters for devices running unpatched versions (pre-6.49.21, pre-7.23.4, pre-7.24.2).

Step 2 — Triggering the Authentication Bypass: The attacker initiates an SSH connection to the target. During the initial handshake, after the server's version exchange and initial key exchange complete, the attacker — without performing any authentication attempt (no username/password, no public key, no keyboard-interactive exchange) — sends a rekey request using SSH_MSG_KEXINIT. On vulnerable builds, the server incorrectly accepts this rekey completion as sufficient state transition to enter the connection protocol phase.

Step 3 — Command Execution: Once the server enters the connection protocol state:

• The attacker sends an SSH_MSG_CHANNEL_OPEN message requesting a session channel.
• After the server responds with CHANNEL_OPEN_CONFIRMATION, the attacker sends an SSH_MSG_CHANNEL_REQUEST with exec request type and a command string.
• The server dispatches the command to the RouterOS command interpreter without verifying authentication state.

Step 4 — Post-Exploitation Impact: With command execution as an unauthenticated user, the attacker achieves:

• File System Manipulation: Create, overwrite, and reconstruct files in the RouterOS managed file namespace. This includes support files containing configuration and diagnostic data. An attacker could overwrite configuration backups, inject malicious startup scripts, or corrupt diagnostic files to mislead forensic analysis.
• Privilege Escalation Potential: Writing to configuration files may allow the attacker to create a new administrative account, modify firewall rules to open additional ports, or disable logging mechanisms.
• Persistence: By crafting files that survive reboots (e.g., auto-load scripts or modified configuration), the attacker can maintain long-term access.
• Lateral Movement: Compromised routers can be used as pivot points into internal networks, especially in enterprise environments where MikroTik devices segment network zones.

Note: No public PoC is available; this attack chain is inferred from the vulnerability class and protocol-level behaviors described in the NVD record.

Impact Assessment

Confidentiality: High — Unauthenticated attackers can read configuration and diagnostic data stored in the file namespace, potentially extracting credentials, network topology details, VPN configurations, and routing secrets.

Integrity: Critical — The attacker can overwrite configuration files, inject malicious data into support files, and alter system state. This enables persistent backdoor installation and configuration tampering that could redirect traffic or disable security controls.

Availability: Medium — While the described file operations do not directly indicate denial-of-service capability, an attacker could overwrite critical configuration files with malformed content, potentially rendering the device non-functional or forcing unexpected reboots.

Affected Systems:

• All RouterOS builds prior to 6.49.21 (Long-term branch)
• All RouterOS builds prior to 7.23.4 (Long-term branch)
• All RouterOS builds prior to 7.24.2 (Stable branch)

Blast Radius: MikroTik routers are widely deployed globally in enterprise edge networks, ISP customer premises equipment (CPE), wireless internet service provider (WISP) infrastructure, and industrial networks. A vulnerability of this class on network infrastructure devices poses a systemic risk, as compromised routers can serve as silent man-in-the-middle positions for all traversing traffic.

CVSS: A CVSS score has not yet been assigned by the vendor or CISA. Based on the attack vector (network), attack complexity (low), and lack of authentication requirements, the likely CVSSv3 score would be in the 9.0–10.0 critical range; however, this is an estimate and should not be treated as an official value.

Detection Guidance

The following detection content is designed to identify exploitation attempts of the SSH rekey-before-authentication vulnerability.

Sigma Rule

title: Suspicious SSH Rekey Request Before Authentication
id: 0c5f4a92-1c3e-4a9b-8b7f-2de4f5a1c7e9
status: experimental
description: Detects SSH connections where a rekey request occurs prior to any successful authentication event, which may indicate exploitation of CVE-2026-67279 in MikroTik RouterOS.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-67279
author: Valters IT Security
date: 2026-08-15
logsource:
    category: network_connection
    product: ssh
detection:
    selection_ssh_session:
        event.category: network
        network.protocol: ssh
    selection_rekey_before_auth:
        ssh.auth.success: "false"
        ssh.rekey: "true"
    condition: selection_ssh_session and selection_rekey_before_auth
    timeframe: 10s
falsepositives:
    - Broken SSH clients that send rekey messages prematurely
level: high

YARA Rule

rule CVE_2026_67279_RouterOS_SSH_Rekey_Bypass
{
    meta:
        author = "Valters IT Security"
        description = "Detects SSH protocol sequences where a rekey request occurs before authentication in MikroTik RouterOS traffic"
        cve = "CVE-2026-67279"
        date = "2026-08-15"
        version = "1.0"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67279"

    strings:
        // SSH protocol message IDs
        // SSH_MSG_KEXINIT = 20 (0x14)
        $msg_kexinit = { 14 }
        // SSH_MSG_CHANNEL_OPEN = 90 (0x5A)
        $msg_channel_open = { 5A }
        // SSH_MSG_CHANNEL_REQUEST = 98 (0x62)
        $msg_channel_request = { 62 }
        // SSH_MSG_USERAUTH_REQUEST = 50 (0x32) — for detecting absence
        $msg_userauth_request = { 32 }
        // Session channel type string
        $channel_session = "session" ascii wide
        // Exec request type
        $request_exec = "exec" ascii wide

    condition:
        // Look for connection protocol messages (channel_open followed by exec_request)
        // in the absence of a prior userauth_request within a sliding window
        $msg_channel_open at any and
        $msg_channel_request at any and
        $request_exec and
        for any i in (0..#msg_kexinit) : (
            // Rekey present and no userauth in proximity
            @msg_kexinit[i] < @msg_channel_open and
            not $msg_userauth_request in (@msg_kexinit[i] .. @msg_channel_open)
        )
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"ET EXPLOIT MikroTik RouterOS SSH Authentication Bypass CVE-2026-67279 Attempt"; flow:established,to_server; content:"|14|"; depth:1; content:"|5A|"; within:4096; content:"session"; within:256; content:"|62|"; within:4096; content:"exec"; within:256; flowbits:set,cve202667279.attempt; flowbits:noalert; classtype:attempted-admin; sid:2026672001; rev:1;)
alert tcp any any -> any 22 (msg:"ET EXPLOIT MikroTik RouterOS SSH Channel Request Exec Without Prior Auth"; flow:established,to_server; content:"|62|"; depth:1; content:"exec"; within:256; flowbits:isset,cve202667279.attempt; classtype:attempted-admin; sid:2026672002; rev:1;)

Elastic Detection

sequence by destination.ip, source.ip with maxspan=10s
  [network where event.category == "network" and network.transport == "tcp" and destination.port == 22]
  [network where event.category == "network" and network.protocol == "ssh" and ssh.rekey == true and ssh.auth.success == false]
  [network where event.category == "network" and network.protocol == "ssh" and ssh.channel.type == "session" and ssh.request.type == "exec"]

Splunk SPL Query

index=network sourcetype=ssh
| where like(ssh_message, "%KEXINIT%") AND NOT like(ssh_message, "%USERAUTH_REQUEST%")
| transaction host, src_ip, dest_ip maxspan=10s
| where eventcount > 2
| eval rekey_before_auth = mvfilter(match(ssh_messages, "KEXINIT") AND NOT match(ssh_messages, "USERAUTH_REQUEST"))
| search rekey_before_auth="true" AND ssh_messages LIKE "%CHANNEL_OPEN%" AND ssh_messages LIKE "%exec%"
| table _time, src_ip, dest_ip, host, ssh_messages
| rename src_ip as "Source IP", dest_ip as "Destination IP", host as "RouterOS Host"

Wazuh OSSEC Rule

<group name="ssh,">
  <rule id="202679" level="15">
    <decoded_as>ssh</decoded_as>
    <field name="message">\.KEXINIT\.</field>
    <description>SSH: Potential MikroTik RouterOS rekey-before-auth attempt (CVE-2026-67279)</description>
    <group>authentication_failures,</group>
  </rule>

  <rule id="202680" level="15">
    <decoded_as>ssh</decoded_as>
    <field name="message">\.CHANNEL_OPEN\..*session</field>
    <field name="message">\.KEXINIT\.</field>
    <description>SSH: Session channel opened after rekey with no prior auth — CVE-2026-67279 exploitation indicator</description>
    <group>attack,</group>
  </rule>

  <rule id="202681" level="15">
    <decoded_as>ssh</decoded_as>
    <field name="message">\.CHANNEL_REQUEST\..*exec</field>
    <if_sid>202680</if_sid>
    <description>SSH: Exec request sent on session channel without authentication — likely CVE-2026-67279 exploitation</description>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED in the context of publicly observable evidence. While vendor fix versions have been identified (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable), no vendor advisory, patch commit, or CNA-issued confirmation has been observed in tracked threat intelligence sources. This inconsistency suggests either the versions were silently fixed (a common MikroTik practice) or the enumerated versions contain backported fixes not yet formally documented.

1) Immediate Mitigations:

• Restrict SSH Access: Immediately limit SSH access to trusted administrative IP addresses only. Apply strict firewall filters on the RouterOS firewall (input chain) allowing SSH only from management network segments.
• Change SSH Port (Obscurity Only): Change the SSH service to a non-standard port. This is not a security control but reduces mass-scanning exposure.
• Disable SSH if Unnecessary: If SSH management is not strictly required, disable the SSH service entirely and use Winbox over a VPN or out-of-band management interface.
• Network-Level Filtering: Deploy perimeter firewall rules to block SSH access to MikroTik devices from untrusted networks, particularly from the public internet.

2) Patch/Upgrade Steps:

• Upgrade Long-term Branch: Upgrade all devices to RouterOS 6.49.21 (Long-term) or RouterOS 7.23.4 (Long-term).
• Upgrade Stable Branch: Upgrade devices on the stable channel to RouterOS 7.24.2 (Stable).
• Post-Upgrade Verification: After upgrading, run /system package print to confirm the running version matches the patched release.
• Configuration Backup: Before patching, export the current configuration: /export file=backup_before_patch. After patching, verify configuration integrity.

3) Long-Term Hardening:

• Implement Zero-Trust Network Access (ZTNA): Route all administrative access through a jump host with MFA rather than direct SSH exposure.
• Network Segmentation: Place management interfaces on dedicated VLANs or management planes isolated from production traffic.
• Regular Patch Cadence: Subscribe to MikroTik announcement channels and apply security updates within 48 hours for critical infrastructure.
• Monitoring: Deploy the detection content provided above to identify any attempts targeting this vulnerability and retrospective scanning for prior exploitation.
• Audit File Integrity: After upgrading, inspect the file namespace for unexpected files: /file print detail. Check for recently created files or modified timestamps on configuration backups.
• Log Review: Examine SSH logs (/log print where topics~"ssh") for connections displaying anomalous protocol sequences or administrative sessions without prior authentication logs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-67279
2. MikroTik RouterOS Changelog (Long-term): https://mikrotik.com/download/changelogs — Refer to 6.49.21 and 7.23.4 entries
3. MikroTik RouterOS Changelog (Stable): https://mikrotik.com/download/changelogs — Refer to 7.24.2 entry
4. MITRE CWE-841 Reference: https://cwe.mitre.org/data/definitions/841.html
5. CISA KEV Catalog: Not listed (confirmed as of report date)

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence have been reported at the time of this writing. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. However, given the historical pattern of MikroTik RouterOS vulnerabilities being weaponized shortly after disclosure (e.g., CVE-2018-14847, CVE-2023-30799), and the high value of network edge devices as initial access vectors, security teams should assume active exploitation is imminent or underway and prioritize patching accordingly.