CVE-2026-67276

Published Sep 5, 2026

Last updated a month ago

SSH

RouterOS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-67276 is an SSH authentication bypass vulnerability affecting MikroTik RouterOS. The flaw stems from an incomplete verification process of RSA public keys during SSH authentication. Specifically, RouterOS checks the key type and modulus but fails to compare the entire RSA public key, omitting the exponent. This oversight allows an attacker, who possesses knowledge of a user's public modulus, to forge a different key and successfully log in via SSH without needing the corresponding private key. This vulnerability has been actively exploited as part of a larger attack chain dubbed "MikroTrick" and has been addressed in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

Description: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
Source: cvd@cert.pl
NVD status: Analyzed
Products: routeros

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.2
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cvd@cert.pl: CWE-347

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7B88D531-98F2-41B2-AC4F-0170D7DB15C2",
            "versionEndExcluding": "7.23.4",
            "versionStartIncluding": "7.9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A41D6B3C-D321-4C61-B3D5-00F8276CB4AC",
            "versionEndExcluding": "7.24.2",
            "versionStartIncluding": "7.24",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.