Executive Summary: Active Weaponization of Core Network Routing

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive adding CVE-2026-67279 to its Known Exploited Vulnerabilities (KEV) Catalog. The security vulnerability impacts MikroTik RouterOS—the ubiquitous networking operating system deployed across internet service providers (ISPs), telecommunications carrier edge networks, and corporate enterprise gateways worldwide.

Carrying a CVSS v3.1 score of 6.9 (Medium) in isolation, the vulnerability's real-world gravity is catastrophic: threat actors have chained CVE-2026-67279 with an argument-injection flaw (CVE-2026-86060) in an exploit chain designated by threat researchers as "MikroTrick". The combined chain achieves full, unauthenticated remote code execution (RCE) with root privileges against internet-exposed routers, allowing adversaries to intercept transit traffic, modify BGP/OSPF route tables, and establish resilient corporate footholds.

Vulnerability Mechanics: SSH Rekey State Machine Breakdown (CWE-840)

CVE-2026-67279 is rooted in CWE-840: Business Logic Errors (Improper Enforcement of Behavioral Workflow) inside RouterOS's customized SSH daemon. During standard RFC 4253 SSH negotiation, a client and server negotiate cryptographic parameters, perform key exchange, verify user credentials, and finally open interactive channels: 

[Standard SSH State Machine]
1. SSH_MSG_KEXINIT (Initial Key Exchange)
2. SSH_MSG_USERAUTH_REQUEST (User Authentication Phase)
3. Authentication Verified -> SSH_MSG_CHANNEL_OPEN (Command Execution Phase)

In affected RouterOS versions, the daemon's internal state handler contained a critical synchronization defect:

  1. An unauthenticated client initiates the connection and enters the SSH_MSG_USERAUTH_REQUEST phase.
  2. Before supplying valid user credentials, the client deliberately transmits an unexpected SSH_MSG_KEXINIT packet to trigger an out-of-order session key renegotiation (rekey).
  3. The RouterOS SSH state machine processes the rekeying sequence, but erroneously resets its internal security flags, improperly transitioning the unauthenticated socket directly into the post-authentication command processing state.

The "MikroTrick" Exploit Chain & Post-Compromise Telemetry

While bypassing the initial password prompt drops the socket into a constrained shell handler, threat actors weaponize CVE-2026-86060 to break out of the sandbox. By injecting malformed command arguments during the terminal parameter negotiation (such as crafted -o flags passed to internal login helper binaries), the attacker spawns an interactive BusyBox ash shell as the root user.

Threat intelligence telemetry from honeypots and incident response engagements confirms widespread automated exploitation following a standardized post-exploitation playbook:

  • Rogue Administrator Account Creation: Attackers execute RouterOS CLI commands to create backdoor admin accounts, predominantly utilizing the username ops or telemetry_svc: 
    /user add name=ops group=full password="[REDACTED_HIGH_ENTROPY_HASH]"
  • SOCKS Proxy Pivoting: Routers are converted into covert traffic forwarding nodes: 
    /ip socks set enabled=yes port=1080 version=5
  • Configuration Exfiltration: The attacker exports the router's complete configuration (including IPsec pre-shared keys, WireGuard secrets, and network topologies) and transmits the payload to external C2 nodes.

Affected Versions & Remediation Matrix

RouterOS Release Track Vulnerable Firmware Versions Remediation Target Remediation Release Date
RouterOS v7 (Stable) Versions < 7.23.4 RouterOS 7.23.4 or later September 3, 2026
RouterOS v7 (Testing) Versions < 7.24.2 RouterOS 7.24.2 or later September 3, 2026
RouterOS v6 (Legacy Long-term) Versions < 6.49.21 RouterOS 6.49.21 or later September 3, 2026

Forensic Triage & SIEM Detection Playbook

Network engineering and SOC teams must immediately audit all MikroTik fleet hardware for signs of active compromise.

1. RouterOS CLI Compromise Verification Commands

# 1. Audit active users for unknown accounts
/user print detail

# 2. Check for unauthorized SOCKS proxy listeners
/ip socks print

# 3. Inspect scheduled scripts and job hooks
/system script print
/system scheduler print

# 4. Review recent login history in system logs
/log print where message~"logged in" or message~"user"

2. Snort / Suricata Rule: Detect SSH Rekey Auth Bypass Probes

alert tcp any any -> any 22 (
    msg:"CST THREAT-ALERT: MikroTik RouterOS SSH Rekey Auth Bypass Probe (CVE-2026-67279)";
    flow:to_server,established;
    content:"SSH-2.0-"; offset:0; depth:8;
    # Detect anomalous rekey initiation immediately following auth request packet sequence
    content:"|14|"; distance:1; within:1; # SSH_MSG_KEXINIT byte
    classtype:attempted-admin;
    sid:202609261;
    rev:1;
)

Mandatory Mitigation Checklist

  1. Upgrade RouterOS Immediately: Apply the latest firmware update using the RouterOS automatic package utility: 
    /system package update set channel=stable
/system package update check-for-updates
/system package update install
  2. Disable Public SSH Ingress: Immediately restrict SSH access to dedicated management subnets or VPN tunnels, disabling WAN exposure: 
    /ip firewall filter add chain=input protocol=tcp dst-port=22 in-interface-list=WAN action=drop comment="Drop WAN SSH"
  3. Purge Backdoor Accounts & Rotate Secrets: Remove any unapproved administrative accounts, regenerate SSH host keys, and rotate all site-to-site VPN credentials.