> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-67279 MikroTik RouterOS: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-67279-mikrotik-routeros-mikrotik-routeros-improper-enforcement-of-behavioral-workflow-vulnerability/ - Published: 2026-09-25T16:21:33.000Z - Updated: 2026-09-25T16:21:33.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-67279, CVE-2026-86060 ## 1\. Executive summary CVE-2026-67279 is a medium-severity flaw (CVSS 6.9, CWE-841) in MikroTik RouterOS that lets an unauthenticated client open a session channel and send an exec request, and it is listed in CISA KEV with an added date of 2026-09-25\. The flaw is designed to be chained into CVE-2026-86060, a critical (CVSS 9.2, CWE-88) argument-delimiter flaw that lets an attacker rewrite the trusted RouterOS policy mask and escalate privilege; that second CVE is also in CISA KEV, added 2026-09-10\. The combination is the material risk: neither CVE alone gives an unauthenticated attacker the full path, but the pair does, and both are confirmed exploited in the wild. Any EMEA financial services firm running internet-exposed RouterOS on edge, branch, or CPE roles should treat this as an active exploitation event, not a routine patch. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | CISA KEV lists both CVE-2026-67279 and CVE-2026-86060 as exploited, and the vendor fix is a RouterOS upgrade that may require a device restart. | The incident-management process must cover the detection, triage and remediation of an exploited edge device, including the maintenance window and any service interruption the upgrade causes. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Confirmed exploitation of an internet-facing network device that terminates or routes client traffic. | Firms must classify the event against their own criteria; an exploited RouterOS edge device that carried client traffic is a candidate major incident, and the classification decision must be recorded. | | NIS2 Art. 21(2)(d): supply chain security measures | The affected product is third-party network infrastructure (MikroTik RouterOS) and the fix is a vendor-supplied upgrade. | Supply-chain security measures must cover how the RouterOS dependency is inventoried, how vendor security updates are received and applied, and how the exposure of that supplier's product is assessed. | ## 3\. Technical analysis & attack chain The two CVEs are a chain, not two independent bugs. CVE-2026-67279 is the entry step and CVE-2026-86060 is the escalation step. 1. An unauthenticated client reaches the RouterOS service and opens a session channel. 2. The client sends an exec request over that channel. RouterOS fails to enforce the behavioural workflow that should gate this, which is the CWE-841 condition in CVE-2026-67279. 3. The exec request reaches the command-handling path affected by CVE-2026-86060, where argument delimiters are not neutralised (CWE-88). 4. The attacker uses that to change the trusted RouterOS policy mask. 5. The changed policy mask grants privilege escalation on the device. The verified reference data records CVE-2026-67279 at CVSS 6.9 MEDIUM with EPSS 1%, and CVE-2026-86060 at CVSS 9.2 CRITICAL with EPSS 2%. Both are in CISA KEV. The low EPSS figures sit alongside confirmed KEV exploitation, which is the pattern to expect when exploitation is targeted at a specific device class rather than broad opportunistic scanning; do not read the EPSS percentages as evidence the chain is not being used. The source material does not name the affected RouterOS versions, the specific service or port that exposes the session channel, the exact command syntax used in the exec request, or the vendor advisory reference. Those specifics are missing from the sources provided and are not reproduced here. The CISA entry gives a due date of 2026-09-28 for CVE-2026-67279 and 2026-09-13 for CVE-2026-86060; the second date has already passed. A third RouterOS CVE, CVE-2026-67277, appears in the related sources. It is a missing-authentication flaw in the btest service that allows kernel memory disclosure and denial of service, with a CISA due date of 2026-09-13\. It is not part of the CVE-2026-67279 chain and the verified reference data does not cover it, so its severity is not assessed here. It is relevant only as evidence that RouterOS is under sustained attention. No malware family, tooling, command-and-control infrastructure, or threat actor is named in any source. There is no attribution to report. CISA records known ransomware campaign use for both CVEs as "Unknown", so this advisory does not characterise the activity as ransomware. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every MikroTik RouterOS instance and mark which ones are reachable from the internet. The chain begins with an unauthenticated client reaching a session channel, so internet exposure is the deciding factor in priority. - Apply the vendor mitigation for CVE-2026-67279 and CVE-2026-86060\. The sources direct clients to vendor instructions and to CISA BOD 26-04; they do not name a fixed version, so confirm the target release against the MikroTik advisory before scheduling the upgrade. - Where the upgrade cannot be applied immediately, remove internet reachability to the RouterOS management and session services. Restrict access to a management network or VPN, and block the exposed service at the perimeter. - Treat any RouterOS device that has been internet-exposed since 2026-09-10 as potentially compromised. The CVE-2026-86060 KEV date is the earliest point at which exploitation is confirmed. P2 (within 72 hours) - Review RouterOS policy masks on all devices against the intended baseline. CVE-2026-86060 works by changing the trusted policy mask, so a mask that differs from the documented configuration is the primary post-exploitation artefact to look for. - Pull authentication and session logs for the exposed period and look for session channels opened by clients that should not have had access, and for exec requests from those sessions. - Check the btest service state on any device where it is enabled, given CVE-2026-67277 in the related sources. P3 (within 7 days) - Add RouterOS devices to the asset inventory with firmware version, exposure state, and the date of the last vendor security update, so the next KEV entry in this product can be triaged without a fresh discovery exercise. - Confirm the DORA Art. 18 classification decision for any device that carried client traffic while exposed, and record it. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, file paths, or command strings. The sources do describe observable behaviour, which is recorded separately below. These are behavioural indicators, not atomic indicators, and are not placed in the copyable block. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | Unauthenticated client opens a session channel on RouterOS | RouterOS session and service logs; network flow records to the exposed service | Medium. Described in the CVE-2026-67279 entry, but the service and port are not named in the sources. | | Exec request sent over a session channel by a client that did not authenticate | RouterOS session logs | Medium. Same limitation. | | Trusted RouterOS policy mask changed from its baseline | RouterOS configuration and policy state; configuration diff against a known-good baseline | Medium. Described in the CVE-2026-86060 entry. | | Kernel memory disclosure or denial of service in the btest service | RouterOS system logs; btest service availability | Low. Single-sourced from the CVE-2026-67277 entry, which is outside the verified reference data. | ## 6\. Detection The sources contain no file artefacts, command strings, mutex names, registry keys, or filenames. There is nothing to build a YARA rule from, and a rule keyed on the CVE identifiers or the product name would detect reporting about the flaw rather than the flaw itself. The behavioural indicators in §5 do support a Sigma rule. The rule below targets the escalation step, a RouterOS policy mask change, which is the observable that survives on the device after the chain completes. ```yaml title: MikroTik RouterOS Policy Mask Change id: 8f2c1a44-6b7e-4d19-9c3a-2e5f0b7d1a88 status: experimental description: Detects a change to the RouterOS policy mask, the escalation step in the CVE-2026-67279 and CVE-2026-86060 chain. author: Adverse Trace date: 2026-09-25 references: - https://nvd.nist.gov/vuln/detail/CVE-2026-67279 - https://nvd.nist.gov/vuln/detail/CVE-2026-86060 logsource: product: mikrotik service: routeros detection: keywords: - 'policy' - 'mask' condition: all of keywords fields: - user - src_ip falsepositives: - Legitimate administrative policy changes during a maintenance window level: high ``` The rule is deliberately broad because the sources do not give the exact log field names or the command syntax. Tune the keywords against a real RouterOS log sample before enabling it at high severity, and correlate hits with an unauthenticated session channel opening shortly beforehand. ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-86060](https://nvd.nist.gov/vuln/detail/CVE-2026-86060?ref=f4n6.co.uk) | 9.2 Critical | ⚠ KEV 2026-09-10 | 2% | RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, a… | | [CVE-2026-67279](https://nvd.nist.gov/vuln/detail/CVE-2026-67279?ref=f4n6.co.uk) | 6.9 Medium | ⚠ KEV 2026-09-25 | 1% | RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted,… | ## 7\. Sources - NVD, CVE-2026-67279 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-67279, published 2026-09-24. - CISA Known Exploited Vulnerabilities, CVE-2026-86060, MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-86060. - CISA Known Exploited Vulnerabilities, CVE-2026-67277, MikroTik RouterOS Missing Authentication for Critical Function Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-67277. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-67279 as medium on its own (CVSS 6.9) and the chain it forms with CVE-2026-86060 as critical, because the pair converts an unauthenticated session into privilege escalation on an internet-facing network device, and both CVEs are in CISA KEV with confirmed exploitation. The client impact is concentrated in firms that run RouterOS at the edge or in branch and CPE roles, where a compromised device sits in the traffic path. Attribution is unconfirmed: no source names an actor, and the verified reference data contains no MITRE ATT&CK profile for this activity, so we make no attribution claim. The IOC set is empty and the behavioural indicators are single-sourced or drawn from CVE entries rather than incident reporting; verify them against your own RouterOS logs before enforcing. We will track the MikroTik advisory for the affected version range and the fixed release, since the sources do not provide either, and we will update this note when that detail is available. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-67279?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*