SSH state-machine flaw lets unauthenticated clients run exec requests on MikroTik RouterOS (CVE-2026-67279)
CERT Polska published the full MikroTrick technical analysis on 2026-09-22 after reporting active exploitation on 2026-09-05, so routers with SSH reachable from untrusted networks that are still on pre-fix builds are now exposed to attackers armed with public details.
RouterOS's SSH server enters the connection protocol after a client-requested rekey even though authentication never happened, so an unauthenticated client can open a session channel and issue exec requests. Chained with a second RouterOS flaw (the "MikroTrick" chain), this lets an attacker create and overwrite files in the managed file namespace and take full administrative control of an internet-exposed router without a password or key.
Affected: MikroTik RouterOS >= 7.24 < 7.24.2; MikroTik RouterOS >= 7.0.0 < 7.23.4; MikroTik RouterOS >= 6.0.0 < 6.49.21
How to Test
Check the installed version under System/Packages (or via Check For Updates); anything below 6.49.21, 7.23.4 or 7.24.2 is vulnerable. Check whether SSH is reachable from untrusted networks. Review the Log section for a critical entry stating the device has been "Flagged" — RouterOS sets this status when it detects compromise — and, even if not flagged, inspect the configuration after upgrading for unknown scripts, users or other settings you do not recognise.
How to Patch
Upgrade to RouterOS 6.49.21 (long-term), 7.23.4 (long-term), 7.24.2 (stable) or 7.25 beta 3 via System/Packages > Check For Updates or the MikroTik download page. Until then, restrict SSH to trusted source IPs only, or close management ports entirely and reach the router over a VPN such as WireGuard.