CVE-2026-67279 · High · CISA KEV

MikroTik RouterOS: Unauthenticated Session Opening Enables Chained Exploitation

Threat Engine Auto-Feed · data current as of 2026-09-25

A critical vulnerability in MikroTik RouterOS allows an unauthenticated client to open a session channel and send an exec request. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, and can be chained with CVE-2026-86060 for further impact. Organizations using MikroTik RouterOS are at risk.

  • CVSS:
  • EPSS percentile: 0.51535
  • Exploitation pressure: 56/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 52th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves an improper enforcement of behavioral workflow, meaning the system fails to correctly validate or restrict the sequence of operations an unauthenticated user can perform. Specifically, it allows an unauthorized client to initiate a session and send execution commands, bypassing intended security controls.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Any organization utilizing MikroTik RouterOS devices, especially those in critical network infrastructure roles.
  • Financial services and Technology sectors, given the assessed targeting by sophisticated threat actors.

Misconfigurations that escalate it

  • Lack of timely patching for network infrastructure devices.
  • Insufficient network segmentation that could limit the blast radius if a router is compromised.

High-impact scenarios

  • Unauthenticated remote code execution when chained with CVE-2026-86060, leading to full device compromise.
  • Network disruption or unauthorized access to internal networks if an attacker gains control of a critical router.
  • Potential for data exfiltration or further lateral movement within the network by financially motivated or state-sponsored actors.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor network traffic for unusual session initiation or exec requests originating from unauthenticated clients targeting MikroTik RouterOS devices.
  • Regularly review MikroTik RouterOS logs for suspicious activity or unauthorized access attempts.

Contain

  • Isolate affected MikroTik RouterOS devices from critical network segments if immediate patching is not feasible.
  • Implement strict access controls and network segmentation to limit potential lateral movement from a compromised router.

Patch

  • Apply the latest security updates and patches provided by MikroTik for RouterOS immediately, prioritizing devices exposed to the internet or critical network segments.
  • Ensure all MikroTik RouterOS devices are updated to versions that address both CVE-2026-67279 and CVE-2026-86060.

Frontier verdict — High

High priority due to active exploitation in the wild (CISA KEV) and its role as an unauthenticated precursor to further compromise in MikroTik RouterOS.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.