CVE-2026-67278Disclosure(mikrotik / routeros)

MEDIUMCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch mikrotik routeros systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

mikrotik CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-347

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

routeros

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 3d ago at 1 mentions (2026-09-05); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

mikrotik

Products

routeros

Deep dive

Activity timeline4 mentions / 4d

Signal classification3 categories

Disclosure

250.0%

Exploit

125.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-05	1	Disclosure1
2026-09-07	1	Disclosure1
2026-09-08	1	Exploit1
2026-09-23	1	Patch1

Full discourse4 posts

YogSotho@YogSoth043d
Exploit
🧨🧨🧨 MIKROTRICK 🧨🧨🧨 Weaponized MikroTik RouterOS exploitation framework. - CVE-2026-67279 - CVE-2026-86060 - CVE-2026-67276 - CVE-2026-67281 - CVE-2026-67277 - CVE-2026-67278 - CVE-2025-61481 - CVE-2025-10948 - CVE-2018-14847 Now available at my beloved ❤️ https://gibliz.taile5d4a8.ts.net/0days/ #exploit #rce #vulnerabilities #cve #0days #mikrotik #router #cybersecurity #infosec #antisec #linux
Post summary
The post announces a weaponized MikroTik RouterOS exploitation framework for several CVEs, providing a URL to download exploit code, but offers no information on patches, active attacks, or technical vulnerability specifics.
720277765.2K
2.0K followersView on X
DMNTR Network Solutions 👻 AS204773@weareDMNTRs45d
Disclosure
- CVE-2026-86060 — Escalada de privilegios vía manejo de argumentos en el proceso de login SSH (sesión SSH no autenticada). - CVE-2026-67281 — Lectura de ficheros sin autenticación en WebFig (/jsproxy), con posible exposición de ficheros de configuración y credenciales. - CVE-2026-67279 — Ejecución de peticiones exec por SSH sin autenticación previa, permitiendo creación y sobrescritura de ficheros gestionados por RouterOS. - CVE-2026-67278 — Aceptación de firmas RSA/PKCS#1 v1.5 malformadas en la validación X.509, habilitando suplantación de servidores TLS. - CVE-2026-67277 — Sesiones btest "related" sin autenticación completada, con fuga de memoria de buffers de kernel y posible reinicio del equipo (denegación de servicio). - CVE-2026-67276 — Comparación incompleta de clave pública RSA en autenticación SSH, permitiendo autenticarse como un usuario autorizado sin disponer de su clave privada.
Post summary
The post lists six newly disclosed CVEs, detailing unauthenticated or privileged operations that could lead to privilege escalation, file read, remote execution, SSL spoofing, memory corruption, and key misuse. No PoC, exploit, or patch is provided.
513061124.7K
25.9K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or re… https://www.cve.org/CVERecord?id=CVE-2026-67278
Post summary
The text discloses a CVE involving malformed RSA signatures in MikroTik RouterOS, noting that a root CA with e=3 could be abused during X.509 validation.
020301.2K
58.1K followersView on X
zoomeyebot@zoomeyebot28d
Patch
🚨 MikroTik RouterOS RSA Signature Verification Flaw Enables SSH Authentication Bypass Critical Vulnerability Alert! MikroTik RouterOS (7.x branch, before 7.23.6 / 7.24.3) is affected by CVE-2026-67278. 🔍 Identify Targets via ZoomEye: Search Dork: os="RouterOS" && service="ssh" Exposure: 9.6k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=b3M9IlJvdXRlck9TIiAmJiBzZXJ2aWNlPSJzc2gi #Infosec #CyberSecurity #ZoomEye
Post summary
The tweet alerts to a critical RSA signature verification flaw (CVE‑2026-67278) in MikroTik RouterOS before versions 7.23.6/7.24.3 that allows SSH authentication bypass, highlights exposure of ~9.6k instances via ZoomEye scanning, and implies remediation is available in the newer RouterOS releases.
0000038
24 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	mikrotik	routeros	-	-	-

Explore more

Back to dashboard mikrotik CVEs routeros vulnerabilities

What researchers are saying

CVE-2026-67278

YogSotho[verified]@YogSoth0Exploit

The post announces a weaponized MikroTik RouterOS exploitation framework for several CVEs, providing a URL to download exploit code, but offers no information on patches, active attacks, or technical vulnerability specifics.

DMNTR Network Solutions 👻 AS204773[verified]@weareDMNTRsDisclosure

The post lists six newly disclosed CVEs, detailing unauthenticated or privileged operations that could lead to privilege escalation, file read, remote execution, SSL spoofing, memory corruption, and key misuse. No PoC, exploit, or patch is provided.

zoomeyebot[verified]@zoomeyebotPatch

The tweet alerts to a critical RSA signature verification flaw (CVE‑2026-67278) in MikroTik RouterOS before versions 7.23.6/7.24.3 that allows SSH authentication bypass, highlights exposure of ~9.6k instances via ZoomEye scanning, and implies remediation is available in the newer RouterOS releases.

CVE@CVEnewDisclosure

The text discloses a CVE involving malformed RSA signatures in MikroTik RouterOS, noting that a root CA with e=3 could be abused during X.509 validation.