CVE-2026-67277Active Exploitation(mikrotik / routeros)

CRITICALCVSS 8.2 · HIGHCISA KEV

Exploitation observed; activity peaked at 11 mentions and remains active

Immediate actions

Patch mikrotik routeros systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

mikrotik CVEs Back to dashboard

8.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-13. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exploit / PoC references

https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-306

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

routeros

Threat summary

Active exploitation appears in 24 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
42 mentions across 19 observed days

What's happening

Active exploitation reported across 24 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 20 signals
Technical details provided in 23 signals
Disclosure: 8 classified signals
General: 4 classified signals
Peaked 12d ago at 11 mentions (2026-09-11); latest day: 1
42 total mentions across 19 days

Affected systems

Vendors

mikrotik

Products

routeros

Deep dive

Activity timeline42 mentions / 19d

Signal classification5 categories

Active Exploitation

2460.0%

Disclosure

820.0%

General

410.0%

Patch

37.5%

Exploit

12.5%

Referenced assets51 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-05	2	Disclosure2
2026-09-06	2	Active Exploitation1Disclosure1
2026-09-07	1	Disclosure1
2026-09-08	2	Active Exploitation1Exploit1
2026-09-09	1	Active Exploitation1
2026-09-10	4	Active Exploitation1General1Patch2
2026-09-11	11	Active Exploitation9Disclosure1General1
2026-09-12	1	Active Exploitation1
2026-09-13	4	Active Exploitation3General1
2026-09-14	1	Active Exploitation1
2026-09-15	3	Disclosure2Patch1
2026-09-16	1	Active Exploitation1
2026-09-17	2	Active Exploitation2
2026-09-18	2	Active Exploitation1General1
2026-09-20	1	Active Exploitation1
2026-09-21	1	Disclosure1
2026-10-02	1	Active Exploitation1

Full discourse20 posts

YogSotho@YogSoth043d
Exploit
🧨🧨🧨 MIKROTRICK 🧨🧨🧨 Weaponized MikroTik RouterOS exploitation framework. - CVE-2026-67279 - CVE-2026-86060 - CVE-2026-67276 - CVE-2026-67281 - CVE-2026-67277 - CVE-2026-67278 - CVE-2025-61481 - CVE-2025-10948 - CVE-2018-14847 Now available at my beloved ❤️ https://gibliz.taile5d4a8.ts.net/0days/ #exploit #rce #vulnerabilities #cve #0days #mikrotik #router #cybersecurity #infosec #antisec #linux
Post summary
The message announces a weaponized exploitation framework targeting multiple MikroTik RouterOS CVEs, providing a link that likely hosts PoC/exploit code, with no evidence of active attacks or patches.
720277765.2K
2.0K followersView on X
GovCERT.CZ@GOVCERT_CZ43d
Active Exploitation
🚨 Upozorňujeme na kritické zranitelnosti v RouterOS v zařízeních MikroTik, CVE-2026-67277, CVE-2026-86060, CVE-2026-67276. Zranitelnosti umožňují vzdálené spuštění kódu s administrátorskými oprávněními prostřednictvím služby SSH, přičemž exploit zcela obchází všechny autentizační mechanismy. Zneužití spočívá v odeslání požadavku na ověření s uživatelským jménem „-2“, otevření kanálu relace a vyžádání PTY, kde lze vložením masky zásad RouterOS dosáhnout spuštění kódu s plnými oprávněními bez použití hesla, klíče, podpisu ani jiných přihlašovacích údajů. Aktuálně dochází k masovému zneužívání těchto zranitelností a útočníci po kompromitaci upravují konfiguraci zařízení tak, aby si zajistili trvalý přístup přetrvávající i po aktualizaci firmware. Prvotní zneužití může vytvářet log „login failure for user -2“, další aktivity však nemusí být v logách spolehlivě zaznamenány. Doporučená nápravná opatření zahrnují aktualizaci firmware, kompletní revizi konfigurace, ověření známek kompromitace, zvážení omezení SSH z veřejného internetu a v některých případech i kompletní reinstalaci zařízení. Více informací lze také nalézt na našem Portále, odkaz naleznete v komentáři pod příspěvkem. 📌Doporučujeme zařízení MikroTik aktualizovat na nejnovější verzi.
Post summary
Critical MikroTik RouterOS vulnerabilities (CVE‑2026‑67277/86060/67276) enable remote code execution via SSH with authentication bypass, are widely exploited, and require urgent firmware updates and comprehensive configuration hardening.
417043295.7K
4.3K followersView on X
DMNTR Network Solutions 👻 AS204773@weareDMNTRs45d
Disclosure
- CVE-2026-86060 — Escalada de privilegios vía manejo de argumentos en el proceso de login SSH (sesión SSH no autenticada). - CVE-2026-67281 — Lectura de ficheros sin autenticación en WebFig (/jsproxy), con posible exposición de ficheros de configuración y credenciales. - CVE-2026-67279 — Ejecución de peticiones exec por SSH sin autenticación previa, permitiendo creación y sobrescritura de ficheros gestionados por RouterOS. - CVE-2026-67278 — Aceptación de firmas RSA/PKCS#1 v1.5 malformadas en la validación X.509, habilitando suplantación de servidores TLS. - CVE-2026-67277 — Sesiones btest "related" sin autenticación completada, con fuga de memoria de buffers de kernel y posible reinicio del equipo (denegación de servicio). - CVE-2026-67276 — Comparación incompleta de clave pública RSA en autenticación SSH, permitiendo autenticarse como un usuario autorizado sin disponer de su clave privada.
Post summary
The text lists multiple CVE entries with technical details on privilege escalation and authentication issues across SSH, RouterOS, X.509, and kernel components, but provides no PoC, exploit code, patches, or evidence of active exploitation.
513061124.7K
25.9K followersView on X
وهبي بن محمد@wahbi_440d
Active Exploitation
CISA تضيف ثغرات MikroTik RouterOS إلى كتالوج KEV: CVE-2026-67277 وCVE-2026-86060 ضمن سلسلة MikroTrick المستغلة فعلياً. المتأثرون: أجهزة RouterOS بإدارة SSH/خدمات مكشوفة. ماذا تفعل: الترقية فوراً إلى 6.49.21 أو 7.23.4 أو 7.24.2، وتقييد الإدارة من الإنترنت، ومراجعة الأجهزة المعرّضة. CISA #سيبراني #MikroTik #KEV
Post summary
CISA announces that CVE-2026-67277 and CVE-2026-86060 are actively exploited in MikroTik RouterOS devices, providing upgrade and restriction guidance.
121502001.5K
875.6K followersView on X
CISA Cyber@CISACyber41d
Active Exploitation
🛡️ We added MikroTik RouterOS vulnerabilities CVE-2026-67277 & CVE-2026-86060 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity https://t.co/9L1Qot9oig
Post summary
The MikroTik RouterOS CVEs CVE-2026-67277 and CVE-2026-86060 are listed in the DHS KEV Catalog, indicating they are being exploited in the wild, and the text urges organizations to apply mitigations.
09022312.3K
303.3K followersView on X
D0xed Dev@D0xedDevi012d
🟦😎 CISA KEV: MikroTik RouterOS CVE-2026-67277. btest takes a connection before auth completes — an unauthenticated client leaks kernel memory and restarts routers over UDP. No creds, no click. Patch to 6.49.21 / 7.23.4 / 7.24.2 · intel: @PCMedicalist 🟦
12020150
3.1K followersView on X
The Shadowserver Foundation@Shadowserver38d
General
These should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 https://nvd.nist.gov/vuln/detail/cve-2026-67277 You can find all our MikroTik detections in Device ID report https://www.shadowserver.org/what-we-do/network-reporting/device-identification-report/ (around 3M daily): https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=mikrotik&dataset=count&limit=100&group_by=geo&stacking=stacked&auto_update=on
Post summary
The text mentions CVE-2026-67277 and warns that affected systems should not be publicly accessible, but it provides no PoC, exploit, active exploitation, patch, or technical vulnerability details.
110301.3K
22.0K followersView on X
서버쟁이 놀이터@ueo0j39d
Active Exploitation
📊 9/13 통합 브리핑 개발 파이프라인이 이번 주 공격면의 중심이다. GitLab CVSS 10.0은 내일(9/14) KEV 마감이고, JFrog·ScreenConnect도 같은 주에 악용이 확인됐다. 말은 "속도 조절"인데 SpaceX·Oracle 쪽 자본은 반대로 움직인다. —— 오늘 먼저 —— ① GitLab CVE-2026-85706 — 내일(09-14) KEV 마감 자체 호스팅이면 19.1.8 / 19.2.6 / 19.3.2+. 패치 후 CI 변수·토큰·secrets.yml 회전 + 9/11 이전 접근 로그 포렌식. ② JFrog Artifactory · ScreenConnect — KEV, 실제 악용 CVE-2026-42016/42018(익명→관리자 체인)·CVE-2026-84869. 아티팩트 저장소·원격 접근 도구부터 버전·노출 확인. ③ Check Point VPN 2건 — 아직 악용 전 = 패치 창 CVE-2026-85102/85103 (CVSS 9.8 무인증 RCE). LivePatch Take 24 / Jumbo Hotfix. 네덜란드 NCSC "악용 임박". ④ GitHub Actions self-hosted — 내일(09-14) 브라운아웃 최소 버전 2.329.0. 9/14·16·18 등록·실행 차단, 9/25 전면. AMI·이미지·bootstrap까지 같이 올려야 CI가 안 멈춘다. ⑤ LiteLLM 예제 키 · Kiro/projen — 로컬·게이트웨이 위생 노출 LiteLLM 10곳 중 1곳이 sk-1234. Kiro 0.8.135+, projen 0.103.0+ 후 tasks.json 재생성. —— AI —— ──────── ▣ 🔴 Anthropic — 중국 7개 랩 '산업 규모' Claude 증류 공개 핵심: Alibaba·Moonshot·DeepSeek·Zhipu·MiniMax·Xiaomi·SenseTime 실명 지목. 최대 캠페인 GTG-16005(Alibaba 계열)는 5~7월 1억 5,100만 교환·피크 일 300만·위조 계정 3,500+. 제품 대응: 리셀러 차단, 응답 전 추론 요약, preserved thinking(다중 턴 추론 암호화). 왜 중요한가: 담론이 아니라 API 응답 형태가 바뀐다. 추론 토큰을 파싱·후처리하는 파이프라인은 오늘 재점검. 귀속·피해 규모는 Anthropic 자체 집계. https://www.anthropic.com/threat-intelligence-report-september-2026 ──────── ▣ Anthropic 위협 보고서 — GTG-10007 월 제로데이 후보 12건+ 핵심: 2025-12~2026-08, 7개 오용 영역. GTG-10007은 약 50개 조직 표적·한 달에 제로데이 후보 12건 이상. GTG-50014(ShinyHunters 계열)는 EC2 워커로 APK 180만·1TB+ 유출. 왜 중요한가: "AI가 공격 비용을 낮춘다"가 집계 가능한 숫자로 왔다. 에이전트 권한 경계·자격증명 노출·egress 통제를 다시 볼 근거. https://thehackernews.com/2026/09/anthropic-says-seven-china-based-ai.html ──────── ▣ Amodei 속도 조절 제안 · Altman 2026 IPO 부정 — 별개 사건 핵심: Amodei가 프론티어 페이스 조절을 제안. 같은 주 Altman은 안전 우려로 2026 IPO 부정을 시사하고 사내에서도 속도 조절 가능성을 언급(Bloomberg→Reuters). 구속력 있는 업계 합의는 없다. 왜 중요한가: "업계가 늦추기로 했다"는 요약은 틀리다. 같은 주 자본 집행은 반대로 감. 3번째 제안 항목(중국 공조 vs 칩 판매 제한)은 원문 간 충돌 — 인용 전 원문 대조. https://www.reuters.com/business/anthropic-ceo-urges-ai-companies-slow-model-development-2026-09-12/ ──────── ▣ Garry Tan — "미국 오픈웨이트 랩도 증류해야" 핵심: Anthropic 고발 직후 YC Garry Tan이 미국 오픈웨이트 진영도 프론티어 증류가 필요하다고 주장. 왜 중요한가: 같은 주에 "증류=탈취"와 "증류=전략"이 동시 출현. 법적 정의 없이 preserved thinking 같은 기술 방어가 규범보다 먼저 배치되는 중. https://techcrunch.com/2026/09/11/y-combinators-garry-tan-wants-u-s-open-weight-ai-labs-to-distill-frontier-models-too/ —— 클라우드·데이터센터·인프라 —— ──────── ▣ SpaceX 컴퓨트 리스 — 합산 연 411억 달러 핵심: Communacopia에서 신규 계약 연 133억(월 11.1억), 매출 인식 2026-12~. 고객 비공개. 기존 Anthropic·Google Cloud·Reflection과 합산 연 411억. 올해 네 번째 대형 AI 용량 계약. 왜 중요한가: 궤도·위성 컴퓨트가 실험이 아니라 가격표 있는 매출 라인. 지상 DC 전력·부지 제약의 대안 경로가 숫자로 열렸다. https://www.datacenterdynamics.com/en/news/spacex-signs-compute-contract-valued-at-133bn-annually/ ──────── ▣ Oracle FY2027 Q1 — OCI +121%, RPO $6,640억, capex $285억 핵심: 총매출 $193억(+30%), OCI $74억(+121%), RPO $6,640억, 분기 DC 850MW 추가, capex $285억(전년 $85억). GPU 약 30만 장 인도 보도(DCD). 왜 중요한가: RPO는 AI 수요가 계약으로 잠긴 가장 단단한 공시. 동시에 capex 3배+는 수익성 전환이 뒤로 밀린다는 뜻 — 둘을 같이 읽어야 한다. https://investor.oracle.com/investor-news/news-details/2026/Oracle-Announces-Q1-Results-Driven-by-Triple-Digit-Growth-in-Cloud-Infrastructure-Revenues/default.aspx ──────── ▣ Microsoft 2032년 38GW — Bloomberg 보도, 공식 확인 아님 핵심: 현재 ~12GW → 2032년 38GW 계획으로 보도. AI 전용은 현재 ~2GW에서 약 1/3까지. 자체+네오클라우드(CoreWeave·Nscale·Lambda 등) 병행. 왜 중요한가: 사실이면 Azure 용량 부족 완화 단서. 다만 Microsoft 미확인·인허가 변수 큼. "보도에 따르면"을 빼고 인용하면 오류. https://www.bloomberg.com/news/features/2026-09-10/microsoft-ai-focused-data-center-plan-to-add-26-gigawatts-of-compute ──────── ▣ UAE 5GW AI DC — 단일 캠퍼스에서 분산·방호로 재설계 핵심: 지역 공격 이후 아부다비 단일 캠퍼스 중심 계획을 다수 시설 분산으로 수정 검토. 지하화·방폭·방공까지 설계 요소로(Reuters). 왜 중요한가: AI 인프라 기준이 GPU·전력을 넘어 지정학·물리 복원력으로. DR에 "리전 소실" 시나리오를 넣을 공개 근거. https://www.reuters.com/world/middle-east/uae-revises-ai-data-center-plan-after-iranian-attacks-sources-say-2026-09-11/ —— 보안·규제 —— ──────── ▣ 🔴 EU CRA 의무 보고 — 어제(09-11)부터 법적 효력 핵심: EU 시장 디지털 요소 제품 제조사는 악용 중인 취약점·심각 사고를 ENISA SRP로 신고. CSIRT→ENISA→회원국 전파, 패치 전까지 비공개 원칙. OSS 스튜어드 의무는 2027-12-11~. 왜 중요한가: 담론이 아니라 어제부터의 법적 의무. 취약점 프로세스에 "EU 신고"를 넣고, 조기 공지 정책과 충돌 조항을 고쳐야 한다. https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched ──────── ▣ Revolut — 위조 정부기관 데이터 요청에 고객정보 유출 핵심: 정상 기관처럼 위장한 fake emergency data request에 응답해 권한 없는 제3자에게 민감 고객정보 제공(Reuters). 왜 중요한가: 시스템이 아니라 "적법 절차"가 뚫렸다. 이메일 도메인 신뢰 배제, out-of-band·서명/포털 검증·2인 승인이 법무·데이터 요청 경로에 필요. https://www.reuters.com/legal/litigation/revolut-confirms-sensitive-customer-data-breach-falling-fake-government-requests-2026-09-12/ ──────── ▣ LiteLLM 게이트웨이 — 노출 10곳 중 1곳이 예제 키 sk-1234 핵심: 기본 관리자 키를 그대로 둔 AI 게이트웨이에서 API 키·클라우드 접근 노출(The Hacker News). 왜 중요한가: LLM 게이트웨이는 자격증명 집중 지점인데 배포 위생이 못 따라감. 5분이면 확인되는 오늘 할 일. https://thehackernews.com/2026/09/nearly-1-in-10-exposed-litellm-gateways.html —— 취약점·해킹 —— ──────── ▣ 🔴 GitLab CVE-2026-85706 — CVSS 10.0, 내일(09-14) 마감 핵심: commits API 경로 탐색+인증 누락 → 무인증 임의 파일 읽기. 영향 18.7+ ~ 19.1.8/19.2.6/19.3.2 미만. CISA 09-11 KEV·BOD 26-04 포렌식 트리아지. "공개 프로젝트 1개+" 조건에 기대지 말 것. 왜 중요한가: 소스·CI 시크릿이 대상. 패치만으로 끝이 아니라 시크릿 전면 회전+침해 점검이 완료 조건. 오늘의 1순위. https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog ──────── ▣ 🔴 JFrog Artifactory — KEV 체인, 공급망 직결 핵심: CVE-2026-42016(Incorrect Authorization)·CVE-2026-42018(Improper Authentication) 체인. 익명 토큰→관리자, 백도어 보고. CISA 09-11 KEV, 실제 악용 확인. 왜 중요한가: 아티팩트 장악=빌드 산출물 변조. GitLab(소스)+JFrog(아티팩트)가 같은 날 KEV에 오른 게 이번 주 구조. https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html ──────── ▣ 🔴 Cisco FMC — Qilin 랜섬웨어 연계, KEV 기한 경과 핵심: CVE-2026-20079(CVSS 10.0 인증 우회) 등. 3개 위협 클러스터 악용, Qilin 배포 확인. 연방 기한 09-12 이미 경과. 왜 중요한가: 방화벽 관리 평면이 뚫리면 뒤 네트워크 신뢰가 무너진다. 경계 장비 최우선. 패치+세션 무효화. https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html ──────── ▣ 🔴 Check Point VPN — CVSS 9.8×2, 패치 창이 열려 있음 핵심: CVE-2026-85102/85103 무인증 RCE. 공개 PoC·확인 악용 없음, 네덜란드 NCSC는 임박 경고. 09-09 LivePatch Take 24·Jumbo. 왜 중요한가: 경계 사전인증 RCE는 공개 후 수일 내 익스플로잇이 따라온다. 아직 악용 전인 지금이 여유 창. https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/ ──────── ▣ PaperCut — AI 에이전트 수백 개로 440+ 인스턴스 침해 핵심: CVE-2026-81578/82078 실제 악용. 러시아어권 공격자가 AI 에이전트 수백 개로 익스플로잇 개발. 긴급 패치→정식 릴리스 대체. 왜 중요한가: "AI로 만든 공격"이 마케팅이 아니라 피해 규모로 남음. GTG-10007과 같은 비용 곡선. https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html ──────── ▣ Microsoft 9월 패치 — 약 970건, 악용 중 제로데이 2건 핵심: 매체별 966~974건(집계 차이, 오보 아님). 악용 중 CVE-2026-81963(Update 스택 권한 상승)·CVE-2026-85880(ALPC). MS는 건수 폭증 원인으로 AI 기반 발견 도입을 듦. 왜 중요한가: "역대 최악"이 아니라 발견 방식 변경. 실무는 악용 중 2건에 집중. https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/ ──────── ▣ MikroTik RouterOS 2건 — KEV(09-10) 핵심: CVE-2026-67277(인증 누락)·CVE-2026-86060(명령 인자 인젝션). 악용 확인. 펌웨어 업그레이드+관리면·btest 인터넷 노출 차단. 왜 중요한가: 소규모·홈랩도 노출 여부부터. BOD 26-04 적용 대상. https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog ──────── ▣ Kiro IDE · projen — 리포가 개발자 PC 설정을 바꾼다 핵심: Kiro CVE-2026-89332(<0.8.135) — 조작된 리포가 Powers registry를 바꿔 workspace 데이터 유출. projen CVE-2026-89065/89066 — 경로 탐색·명령 삽입, 0.103.0+ 후 tasks.json 재-synthesize 필수. 왜 중요한가: 코딩 에이전트가 설정을 쓸 수 있다는 것 자체가 공격면. 리포·생성 설정 파일을 신뢰 경계 안에 두지 말 것. https://aws.amazon.com/security/security-bulletins/2026-111-aws/ —— 개발자·엔터프라이즈 —— ──────── ▣ ⏰ GitHub Actions self-hosted — 내일부터 브라운아웃 핵심: 최소 버전 2.329.0. 09-14·16·18 구형 러너 등록·실행 차단, 09-25 전면. 최신 릴리스 후 30일 내 업데이트 필요(GitHub 공식). 왜 중요한가: 보안 이슈가 아니라 날짜 확정 운영 중단. fleet·AMI·bootstrap을 오늘 확인하지 않으면 내일 CI가 멈춘다. https://github.blog/changelog/2026-06-12-github-actions-minimum-version-enforcement-timeline-for-self-hosted-runners/ ──────── ▣ Microsoft — Rust를 사내 Tier 1 언어로 승격 핵심: Windows 메모리 안전 취약점 제거 목표로 사내 개발자에게 Rust를 1급 언어로 제공(The Register). 왜 중요한가: 실험을 넘어 조직 표준. ~970건 패치와 나란히 읽으면 메모리 안전 구멍을 언어 차원에서 끊겠다는 맥락. https://www.theregister.com/devops/2026/09/11/microsoft-annoints-rust-as-a-tier-1-internal-language/5295732 ──────── ▣ GitHub Copilot 지표 — VS Code Agents 세션 포함 핵심: Enterprise/Org 1일·28일 보고서에 Agents 창 활성 사용자·세션·메시지 추가. 왜 중요한가: AI 코딩 측정이 채팅 사용률에서 실제 에이전트 활동으로 이동. 도입 효과 보고 기준을 갈아야 한다. https://github.blog/changelog/2026-09-11-add-vs-code-agents-to-copilot-usage-metrics/ ──────── ▣ Reuters×CuttingRoom — MCP로 뉴스룸 AI 영상 편집 핵심: Reuters MCP 서버+ShortCut 연결. 자연어로 검색·컷·믹싱·색보정·자막·포맷. 뉴스룸이 상호작용·데이터·규칙을 자체 통제. 왜 중요한가: MCP가 개발 도구를 넘어 엔터프라이즈 콘텐츠·데이터 연결 계층으로. tool policy·데이터 소유권 분리 참고 사례. https://www.reuters.com/media-center/reuters-cuttingroom-partner-provide-newsrooms-with-ai-assisted-video-editing-2026-09-12/ 패치 창은 며칠이 아니라 몇 시간이다. 소스·아티팩트·러너부터 오늘 끝내자. #IT브리핑 #GitLab #JFrog #CISA #KEV #CheckPoint #Anthropic #SpaceX #Oracle #EUCRA #GitHubActions #PaperCut #보안패치
Post summary
The briefing highlights several CVEs with confirmed exploitation, detailed technical data, and immediate patch recommendations, underscoring a current active threat landscape.
100401.5K
78 followersView on X
VulnTracker@vuln_tracker40d
Active Exploitation
CVE-2026-67277: an unauthenticated attacker can reach RouterOS's bandwidth-test service before login completes, leaking kernel memory or crashing the device remotely. Actively exploited — added to CISA's KEV catalog. Remediation due September 13. Affected: MikroTik RouterOS Fixed in 7.24.2, 7.23.4, 6.49.21 Details: http://vulntracker.io/cves/CVE-2026-67277 #MikroTik #RouterOS #CVE #VulnTracker
Post summary
CVE‑2026‑67277 is an unauthenticated remote memory‑leak/crash vulnerability in MikroTik RouterOS that is actively exploited and listed in CISA's KEV catalog, with patches released in version 7.24.2, 7.23.4, and 6.49.21.
01030267
815 followersView on X
Canadian Centre for Cyber Security@cybercentre_ca41d
Patch
#CyberAlert | AL26-020 - Vulnerabilities Impacting MikroTik RouterOS Organizations using MikroTik RouterOS should update affected devices immediately and review vendor guidance. https://www.cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060 https://t.co/hnCcR90DJi
Post summary
The alert alerts users of MikroTik RouterOS to immediately apply available patches for the identified CVEs, emphasizing an up-to-date update remedy.
01030791
34.0K followersView on X
DC3 DCISE@DC3DCISE13d
#DCISEWarning: MikroTik RouterOS Flaws Exploited Threat: "MikroTik" chain (CVE-2026-67276/86060) bypasses SSH auth for admin control. DoS (CVE-2026-67277) vuln targets bandwidth test. Action: Patch now & monitor for "user -2" login failures. https://t.co/lPJK9a3z1b
11010158
743 followersView on X
sunil kumawat@Sunil_kumawat1736d
Disclosure
Chain: CVE-2026-67276 (SSH auth bypass, 9.2) + CVE-2026-86060 (crafted-username priv-esc, 9.2) → unauth admin on exposed SSH. Also CVE-2026-67277: unauth bandwidth-test → kernel memory leak / DoS (8.8).
Post summary
The text discloses technical details of multiple CVEs (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277) including vulnerability types and CVSS scores, but provides no PoC, exploit, active exploitation, or patch information.
1001076
22 followersView on X
VulDB 🛡@vuldb46d
Disclosure
A severe vulnerability was disclosed for Mikrotik RouterOS (CVE-2026-67277) https://vuldb.com/vuln/399363
Post summary
The message announces the disclosure of a severe vulnerability, CVE-2026-67277, in Mikrotik RouterOS and provides a link to the vulnerability database entry.
00002187
2.3K followersView on X
Bhavesh Verma@xbhaveshverma19d
Active Exploitation
MikroTik RouterOS Has a Chain of Vulnerabilities, Codenamed “MikroTrick” That Enables Full Administrative Takeover, and CISA Has Set a Federal Deadline. CVE-2026-67279 was added to CISA’s Known Exploited Vulnerabilities catalog on September 25, 2026, with a federal remediation deadline of September 28. The vulnerability chain which also includes CVE-2026-67276 (SSH authentication bypass, CVSS 9.2), CVE-2026-67277 (missing authentication for critical function), and CVE-2026-86060 (SSH session privilege manipulation) allows attackers to achieve full administrative takeover of affected MikroTik RouterOS devices. CERT Polska has observed active exploitation from specific source IP addresses since September 2, 2026. MikroTik routers are widely deployed in small and medium businesses, ISPs, and branch offices often with default credentials and outdated firmware. A compromised router is a silent pivot point for every device behind it. #MikroTik #RouterOS #KEV
Post summary
CERT Polska observed active exploitation of MikroTik RouterOS vulnerability chain (including CVE-2026-67279) since September 2, 2026, and CISA added CVE-2026-67279 to its KEV catalog with a federal remediation deadline. No PoC code, exploit tools, or specific patches are detailed in the text.
1000058
153 followersView on X
SecEngCyGy@snypet8637d
Active Exploitation
CISA KEV due today: MikroTik RouterOS MikroTrick chain. CVE-2026-67277 + CVE-2026-86060 hit internet-exposed SSH. Upgrade to 7.24.2, 7.23.4, or 6.49.21. Restrict SSH; check Flagged status and unknown users/scripts. https://mikrotik.com/supportsec/september-2026-vulnerability/ #CyberSecurity
Post summary
The tweet reports that CVE-2026-67277 and CVE-2026-86060 are actively exploited (CISA KEV) and urges users to upgrade to specific RouterOS versions and restrict SSH to mitigate the risk.
1000062
28 followersView on X
Adam@seoscottsdale38d
Active Exploitation
2/4 PATCH NOW • Check Point VPN: LivePatch Take 24 or Jumbo R81.20 Take 166+ / R82 Take 126+ / R82.10 Take 44+. R82.20 not affected. • JFrog Artifactory chain (CVE-2026-42018 + CVE-2026-42016 → admin + Rust C2). Self-hosted: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20+. • GitLab CVE-2026-85706 path traversal — KEV due Sept 14. Upgrade CE/EE 19.3.2 / 19.2.6 / 19.1.8. • ScreenConnect CVE-2026-84869 — KEV due Sept 14. Server 26.6.5+ and refresh host clients/agents. • MikroTik RouterOS CVE-2026-67277 / CVE-2026-86060 — due Sept 13. Install 6.49.21 / 7.23.4 / 7.24.2.
Post summary
The text is an urgent patch bulletin listing fixed versions for multiple CVEs and explicitly references KEV due dates for GitLab and ScreenConnect vulnerabilities. No PoC or functional exploit code is provided, but KEV references make active exploitation the primary classification.
10000135
12.4K followersView on X
Xavier Rivera@XavierRiveraX39d
Active Exploitation
CISA added 5 exploited-in-the-wild flaws to the KEV catalog: • JFrog Artifactory CVE-2026-42016 (priv-esc) • JFrog Artifactory CVE-2026-42018 (anon token leak) • ConnectWise ScreenConnect CVE-2026-84869 (unauthorized file exec) • MikroTik RouterOS CVE-2026-67277 (unauth memory disclosure) • MikroTik RouterOS CVE-2026-86060 (policy-mask priv-esc) FCEB deadlines: Sep 13 RouterOS, Sep 14 ScreenConnect, Sep 25 Artifactory.
Post summary
CISA has classified five CVEs—two in JFrog Artifactory, one in ConnectWise ScreenConnect, and two in MikroTik RouterOS—as actively exploited in the wild, with specified patch deadlines coming soon.
10000140
605 followersView on X
DFIR Radar@DFIR_Radar42d
Active Exploitation
MikroTik RouterOS hit by actively exploited two-flaw chain 'MikroTrick,' enabling unauthenticated full admin takeover of internet-exposed devices via SSH. Attacks confirmed since at least Sept. 2, 2026. - CVE-2026-67276 (CVSS 9.2): SSH auth bypass via improper RSA public key comparison. An attacker knowing only a username and public modulus can craft a substitute key and log in without the private key, inheriting that account's privileges. CVE-2026-86060 (CVSS 9.2): crafted username triggers privilege escalation to full admin on SSH login. These two form the MikroTrick chain. CVE-2026-67277 (CVSS 8.8) adds kernel memory leakage and remote DoS via the bandwidth-test service. - Observed attacker behavior: creation of a privileged account named 'ops,' failed logins under user '-2' followed by SSH-based user addition. Traffic originated from 82.192.72[.]4 and 103.102.31[.]18. - Post-update, RouterOS scans config at startup and sets a 'Flagged' marker if it detects known compromise traces. Absence of that marker does NOT clear the device. Check logs for the compromise message and inspect for unknown users, scripts, scheduler tasks, proxies, and tunnels. - Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. If patching is blocked, immediately restrict SSH, WWW/WWW-SSL, and bandwidth-test to trusted management IPs only. #DFIR_Radar
Post summary
The post reports that MikroTik RouterOS is being actively exploited via the MikroTrick chain, provides detailed technical information, and offers patch and mitigation guidance.
10000204
1.9K followersView on X
MLAUNCHER@MLUNCHER30d
Disclosure
و شدت بحرانی دارن. علاوه بر اینها، یک آسیب پذیری با شناسه ی CVE-2026-67277 هم گزارش شده که سرویس تست پهنای باند RouterOS رو تحت تأثیر قرار میده و به مهاجمان احراز هویت‌نشده اجازه میده حافظه کرنل رو افشا کنن یا روتر رو از راه دور خراب/راه‌اندازی مجدد کنن
Post summary
The post announces a critical RouterOS vulnerability, CVE-2026-67277, enabling unauthenticated remote kernel memory disclosure or remote crash/restart, without indicating PoC, exploit tooling, active exploitation, or a patch.
0000039
10 followersView on X
kotaro@サイバーセキュリティ情報発信@ngsk_ciso32d
Active Exploitation
米CISAが9月10日、MikroTik RouterOS（拠点や境界で使うルーターのOS）の穴2件（CVE-2026-67277、CVE-2026-86060）をKnown Exploited Vulnerabilities（すでに悪用された穴の名簿）に載せた。CERT Polskaもインターネットに開いたSSH向けの実攻撃を確認している、と書いた。MikroTikは9月3日、直す版を出している。6.xは 6.49.21、7.x Long-Termは 7.23.4、Stableは 7.24.2（Developmentは 7.25 beta 3）。普通の会社だと、拠点間VPNや簡易ルーターにMikroTikを置いている先の話。SSHなどを外に出していると、管理者権限を取られ設定・経路・認証情報まで握られる。置いていなければスキップでよい。今見るのは WinBox／WebFig の「Check for updates」で現行版。足りない台は上記の直す版へ。上げたあと Log の Flagged（侵害の印）、見知らぬユーザ・スクリプト・スケジューラを確認。SSHは信頼網以外へ開けない。 https://mikrotik.com/supportsec/september-2026-vulnerability
Post summary
CISA has listed two MikroTik RouterOS CVEs as actively exploited, with CERT Polska confirming real‑world SSH attacks; fixed firmware versions are provided.
0000073
32 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	mikrotik	routeros	-	-	-

Explore more

Back to dashboard mikrotik CVEs routeros vulnerabilities

What researchers are saying

CVE-2026-67277

YogSotho[verified]@YogSoth0Exploit

The message announces a weaponized exploitation framework targeting multiple MikroTik RouterOS CVEs, providing a link that likely hosts PoC/exploit code, with no evidence of active attacks or patches.

GovCERT.CZ[verified]@GOVCERT_CZActive Exploitation

Critical MikroTik RouterOS vulnerabilities (CVE‑2026‑67277/86060/67276) enable remote code execution via SSH with authentication bypass, are widely exploited, and require urgent firmware updates and comprehensive configuration hardening.

DMNTR Network Solutions 👻 AS204773[verified]@weareDMNTRsDisclosure

The text lists multiple CVE entries with technical details on privilege escalation and authentication issues across SSH, RouterOS, X.509, and kernel components, but provides no PoC, exploit code, patches, or evidence of active exploitation.

وهبي بن محمد[verified]@wahbi_4Active Exploitation

CISA announces that CVE-2026-67277 and CVE-2026-86060 are actively exploited in MikroTik RouterOS devices, providing upgrade and restriction guidance.

서버쟁이 놀이터[verified]@ueo0jActive Exploitation

The briefing highlights several CVEs with confirmed exploitation, detailed technical data, and immediate patch recommendations, underscoring a current active threat landscape.

VulnTracker[verified]@vuln_trackerActive Exploitation

CVE‑2026‑67277 is an unauthenticated remote memory‑leak/crash vulnerability in MikroTik RouterOS that is actively exploited and listed in CISA's KEV catalog, with patches released in version 7.24.2, 7.23.4, and 6.49.21.

Bhavesh Verma[verified]@xbhaveshvermaActive Exploitation

CERT Polska observed active exploitation of MikroTik RouterOS vulnerability chain (including CVE-2026-67279) since September 2, 2026, and CISA added CVE-2026-67279 to its KEV catalog with a federal remediation deadline. No PoC code, exploit tools, or specific patches are detailed in the text.

SecEngCyGy[verified]@snypet86Active Exploitation

The tweet reports that CVE-2026-67277 and CVE-2026-86060 are actively exploited (CISA KEV) and urges users to upgrade to specific RouterOS versions and restrict SSH to mitigate the risk.