Summary
CVE-2026-67276 is a critical MikroTik RouterOS flaw that lets unauthenticated attackers bypass SSH authentication without the user’s private key. RouterOS checks the RSA key type and modulus but not the exponent. Using the same modulus with an exponent of one, attackers can forge authentication and access the SSH command line as the targeted user.
Urgent Actions Required
- Disable SSH if it is not required.
- Restrict SSH access to authorized management IP addresses.
- Review SSH logs and user accounts for suspicious activity, including unexpected ops or -2 accounts.
- Check the device mode for the Flagged status as a potential indicator of compromise.
Which Systems Are Vulnerable to CVE-2026-67276?
Technical Overview
- Vulnerability Type: Improper Verification of Cryptographic Signature (CWE-347)
- CVSS Vector: v4.0
- Attack Vector: Network
- Attack Complexity: High
- Attack Requirements: None
- Privileges Required: None
- User Interaction: None
- Vulnerable System Confidentiality: High
- Vulnerable System Integrity: High
- Vulnerable System Availability: High
- Subsequent System Confidentiality: None
- Subsequent System Integrity: None
- Subsequent System Availability: None
- Patch Availability: Yes, available
How Does the CVE-2026-67276 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-67276?
Vulnerability Root Cause:
CVE-2026-67276 is caused by incomplete RSA key validation. RouterOS checks the key type and modulus but not the exponent, allowing attackers to forge a signature with an exponent of one and bypass SSH authentication.
How Can You Mitigate CVE-2026-67276?
If immediate patching is delayed or not possible:
- Disable SSH if it is not required.
- Restrict SSH access to authorized management IP addresses.
- Review SSH logs for unusual authentication activity.
- Check RouterOS user accounts for unexpected users, including ops or -2.
- Check the device mode for the Flagged status as a potential compromise indicator.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- MikroTik Routers - Devices running vulnerable RouterOS versions
- SSH Services - RouterOS systems with SSH access enabled and reachable over the network
- Exposure Level:
- Internet-facing RouterOS devices - Particularly systems with externally accessible SSH or administrative services
How Can You Detect CVE-2026-67276 Exploitation?
Indicators of Compromise (IOCs/IOAs):
- SSH log entries such as login failure for user -2 via SSH
- Unexpected privileged ops account
- RouterOS device mode showing Flagged
Behavioral Indicators:
- Unexpected SSH access to privileged RouterOS accounts
Alerting Strategy:
- Priority: Critical
- Alert on unusual SSH authentication activity and unexpected privileged accounts.
- Investigate devices showing the Flagged status.
Remediation & Response
- Remediation Timeline:
- Immediate: Update affected RouterOS installations to the applicable fixed version
- After patching: Review SSH logs, user accounts, and device status for signs of unauthorized access
- For compromised devices: Perform a factory reset and rebuild the device with a fresh configuration
- Incident Response Considerations:
- Review SSH logs for suspicious authentication activity
- Check for unauthorized accounts, including ops and -2
- Check whether the device mode shows Flagged
- Investigate known suspicious IP addresses, including 82.192.72.4 and 103.102.31.18
- On confirmed compromised devices, reset and reconfigure the device from a clean state
Find the Threats Other Security Tools Miss
-
-
- Detect and connect weak signals across your environment
- Evaluate findings against known attack vectors
- Improve threat hunting speed and accuracy
- Strengthen post-breach defense with greater confidence
-
References:
