PatchTheCVECVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an author
CVE-2026-67276 is a high-severity flaw (CVSS 8.1) affecting routeros. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects on
Why this priority
- High severity
- EPSS top 5%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 8.9% (top 5%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2026-09-05 |
| Last modified | 2026-09-25 |
Last updated 2026-09-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: dinosn/mikrotrick-poc (102 stars)
- GitHub PoC: BlackHatExploitation/exploit-mikrotik-2026 (14 stars)
- GitHub PoC: 4rt-Net/Mikrotrick_POC (2 stars)
- Write-up: forum.mikrotik.com/t/7-24-2-stable-is-released/272800
Advisories and coverage
Official advisories
- CERT Polska: Vulnerabilities in Mikrotik RouterOS software 2026-09-05
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-67276?
routeros: upgrade to 7.23.4, 7.24.2. Exact commands for each OS are on this page.
Is CVE-2026-67276 being exploited?
CVE-2026-67276 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-67276 affect?
CVE-2026-67276 affects routeros. Severity is high (CVSS 8.1). RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplie
How urgent is CVE-2026-67276?
Priority 62/100. High severity; EPSS top 5%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- CVE-2026-67278 CRITICAL 9.1 UPGRADE MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509
- CVE-2026-67281 HIGH 7.5 UPGRADE RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocat
- CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability