{"schema":"vulnpedia.research/1","cve":"CVE-2026-67279","references":[{"url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve"}]},{"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","tags":["technical-description","Mitigation","Third Party Advisory","KEV report"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]},{"url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","tags":["exploit","Exploit","Third Party Advisory"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"}]},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","tags":["vendor-advisory","Vendor Advisory"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://mikrotik.com/supportsec/september-2026-vulnerability/"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://mikrotik.com/supportsec/september-2026-vulnerability/"}]},{"url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","tags":["release-notes","Release Notes"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802"}]},{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","tags":["release-notes","Release Notes"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"}]},{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","tags":["release-notes","Release Notes"],"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","origins":[{"source":"mitre","sourceId":"CERT-PL","modified":"2026-09-05T20:40:29.029Z","url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"}]},{"url":"https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-26T03:55:45.145Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-26T03:55:45.145Z","url":"https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-26T03:55:45.145Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-26T03:55:45.145Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279"},{"source":"nvd","sourceId":"CVE-2026-67279","modified":"2026-09-26T04:17:47.273","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279"}]},{"source":"euvd","sourceId":"EUVD-2026-72027","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-72027","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://vulncheck.com/xdb/e6043c151106","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"e6043c151106","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e6043c151106","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/e6043c151106"}]},{"url":"https://github.com/gagaltotal/CVE-2026-mikrotik-poc","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"e6043c151106","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e6043c151106","modified":"2026-09-05T00:00:00Z","url":"https://github.com/gagaltotal/CVE-2026-mikrotik-poc"}]},{"url":"https://vulncheck.com/xdb/fc94df1ef6af","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"fc94df1ef6af","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fc94df1ef6af","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/fc94df1ef6af"}]},{"url":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"fc94df1ef6af","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fc94df1ef6af","modified":"2026-09-05T00:00:00Z","url":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit"}]},{"url":"https://vulncheck.com/xdb/9879bd678708","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"9879bd678708","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9879bd678708","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/9879bd678708"}]},{"url":"https://github.com/HackSpeak/CVE-2026-67279","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"9879bd678708","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9879bd678708","modified":"2026-09-05T00:00:00Z","url":"https://github.com/HackSpeak/CVE-2026-67279"}]},{"url":"https://vulncheck.com/xdb/4c8e26e2da1e","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"4c8e26e2da1e","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"4c8e26e2da1e","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/4c8e26e2da1e"}]},{"url":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"4c8e26e2da1e","modified":"2026-09-05T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"4c8e26e2da1e","modified":"2026-09-05T00:00:00Z","url":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/HackSpeak/CVE-2026-67279","source":"poc-in-github","sourceId":"CVE-2026-67279","description":"MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing","modified":"2026-10-03T10:06:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-67279","url":"https://github.com/HackSpeak/CVE-2026-67279"},{"source":"poc-in-github","sourceId":"CVE-2026-67279","modified":"2026-10-03T10:06:31Z","url":"https://github.com/HackSpeak/CVE-2026-67279"}],"tags":[]},{"url":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit","source":"poc-in-github","sourceId":"CVE-2026-67279","description":"CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only.","modified":"2026-10-22T12:20:25Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-67279","url":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit"},{"source":"poc-in-github","sourceId":"CVE-2026-67279","modified":"2026-10-22T12:20:25Z","url":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit"}],"tags":[]},{"url":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC","source":"poc-in-github","sourceId":"CVE-2026-67279","description":"Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42.","modified":"2026-10-08T21:29:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-67279","url":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC"},{"source":"poc-in-github","sourceId":"CVE-2026-67279","modified":"2026-10-08T21:29:16Z","url":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC"}],"tags":[]},{"url":"https://github.com/GoldAden/mikrotrick-verifier","source":"poc-in-github","sourceId":"CVE-2026-67279","description":"Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.","modified":"2026-10-17T22:42:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-67279","url":"https://github.com/GoldAden/mikrotrick-verifier"},{"source":"poc-in-github","sourceId":"CVE-2026-67279","modified":"2026-10-17T22:42:18Z","url":"https://github.com/GoldAden/mikrotrick-verifier"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"e6043c151106","url":"https://vulncheck.com/xdb/e6043c151106","cve":"CVE-2026-67279","dateAdded":"2026-09-25T20:09:37Z","modified":"2026-09-05T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/gagaltotal/CVE-2026-mikrotik-poc","observations":[{"dateAdded":"2026-09-25T20:09:37Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"e6043c151106","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/e6043c151106"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"fc94df1ef6af","url":"https://vulncheck.com/xdb/fc94df1ef6af","cve":"CVE-2026-67279","dateAdded":"2026-09-28T08:27:24Z","modified":"2026-09-05T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit","observations":[{"dateAdded":"2026-09-28T08:27:24Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"fc94df1ef6af","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/fc94df1ef6af"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"9879bd678708","url":"https://vulncheck.com/xdb/9879bd678708","cve":"CVE-2026-67279","dateAdded":"2026-09-28T09:04:54Z","modified":"2026-09-05T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/HackSpeak/CVE-2026-67279","observations":[{"dateAdded":"2026-09-28T09:04:54Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"9879bd678708","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/9879bd678708"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"4c8e26e2da1e","url":"https://vulncheck.com/xdb/4c8e26e2da1e","cve":"CVE-2026-67279","dateAdded":"2026-10-09T12:28:11Z","modified":"2026-09-05T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC","observations":[{"dateAdded":"2026-10-09T12:28:11Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"4c8e26e2da1e","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/xdb/4c8e26e2da1e"}]}],"vendorStatements":[],"exploitationSources":[{"source":"euvd","sourceId":"EUVD-2026-72027","catalog":"ENISA EU KEV","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027","dateAdded":"2026-09-25","origins":[{"source":"euvd","sourceId":"EUVD-2026-72027","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-09-05T00:00:00Z","modified":"2026-09-05T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"MikroTik","product":"RouterOS","dueDate":"2026-09-28T00:00:00Z","cisaDateAdded":"2026-09-25T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","modified":"2026-09-05T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","catalog":"VulnCheck KEV","kind":"report","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","dateAdded":"2026-09-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","catalog":"VulnCheck KEV","kind":"report","url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","dateAdded":"2026-09-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-09-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-67279","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]}]}