9.2

CVE-2026-67276: MikroTrick

CVSS: 9.2v4.0CriticalKEVAnalyzed
Published 05-09-2026Last modified 09-09-2026
Open JSON

Vulnerability summary

CVE-2026-67276 is a critical (CVSS 9.2) vulnerability in MikroTik RouterOS. It is known to be exploited: ENISA lists it, first on 05-09-2026. EPSS estimates a 6.45% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.2/10
010
Critical · v4.0 (CVE.org)
EPSS score
6.45%
0%100%
Low · +6.21 pp in 30 days
KEVListedENISA
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 05-09-2026
    PublishedVulnerability first disclosed.
  2. 05-09-2026
    Added to ENISA KEVMikroTrick
  3. 09-09-2026
    Last modifiedVulnerability information updated.

Description

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

6.45%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

+6.21 pp

From 0.24% on 22-09-2026

22-09-202622-10-2026
EPSS score
6.45%

Known exploited

Compare KEV catalogs
ENISA CNWListed
Added
05-09-2026

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (npratley.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Mikrotik1 product
  • routeros≥ 7.9, < 7.23.4 | ≥ 7.24, < 7.24.2

1 vendor · 1 product

References

6 links