KEV Entry

CVE-2026-67279

Known Exploited Vulnerability Entry ENISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-67279

2026-09-27 00:00 UTC

Timestamps

2026-09-27

2026-09-27

Scope

MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-841 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

References
  • {'id': 'CVE-2026-67279', 'url': 'https://www.cve.org/CVERecord?id=CVE-2026-67279'}
  • {'id': 'EUVD-2026-72027', 'url': 'https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027'}
  • {'id': 'source', 'url': 'https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/'}

3b37d046-4e0c-46ab-8c38-f6fba3cd2fed

ENISA
cce329bf-df49-4c6e-a027-80be2e6483bd

2026-09-27 17:00 UTC

2026-09-27 17:00 UTC

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
csirt_report enisa-cnw-kev successful_exploitation 0.75
View details 
{
  "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON",
  "cwes": [
    "CWE-841"
  ],
  "dateReported": "2026/09/27",
  "euvd": "EUVD-2026-72027",
  "exploitationType": [
    "unknown"
  ],
  "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/",
  "originSource": "CERT.PL",
  "patchedSince": "2026/09/03",
  "product": "RouterOS",
  "threatActorsExploiting": [],
  "vendorProject": "MikroTik",
  "vulnerabilityName": "MikroTrick"
}
 -
Export Options
JSON Object JSON API View Full Catalog