CVE-2026-67279Active Exploitation(mikrotik / routeros)

CRITICALCVSS 6.5 · MEDIUMCISA KEV

Exploitation observed; activity peaked at 19 mentions and remains active

Immediate actions

Patch mikrotik routeros systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

mikrotik CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-28. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exploit / PoC references

https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-841

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

routeros

Threat summary

Active exploitation appears in 43 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
67 mentions across 15 observed days

What's happening

Active exploitation reported across 43 signals
Exploit tool or code specified in 4 signals
PoC mentioned or linked in 11 signals
Patch or workaround mentioned in 34 signals
Technical details provided in 49 signals
Disclosure: 7 classified signals
Peaked 6d ago at 19 mentions (2026-09-26); latest day: 1
67 total mentions across 15 days

Affected systems

Vendors

mikrotik

Products

routeros

Deep dive

Activity timeline67 mentions / 15d

Signal classification6 categories

Active Exploitation

4366.2%

Disclosure

710.8%

Patch

710.8%

PoC

69.2%

Exploit

11.5%

General

11.5%

Referenced assets43 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-05	1	Disclosure1
2026-09-06	2	Active Exploitation1PoC1
2026-09-07	3	Active Exploitation1Disclosure1PoC1
2026-09-08	1	Exploit1
2026-09-18	1	Active Exploitation1
2026-09-23	7	Active Exploitation5Patch2
2026-09-24	4	Active Exploitation3Disclosure1
2026-09-25	8	Active Exploitation6Disclosure1Patch1
2026-09-26	19	Active Exploitation17Patch2
2026-09-27	7	Disclosure2Patch1PoC4
2026-09-28	10	Active Exploitation7Disclosure1General1Patch1
2026-10-02	1	Active Exploitation1
2026-10-05	1	Active Exploitation1

Full discourse20 posts

!Manan@0xManan25d
Active Exploitation
PoC is public. Internet-facing MikroTik SSH → full admin. No password. No key. MikroTrick: CVE-2026-67279 + CVE-2026-86060. Fresh on CISA KEV. Chain: password auth as `-2` (rejected but left sticky) → pre-auth rekey drops the auth gate → `/nova/bin/login` treats `-2` as “read identity + policy from fd 2” → all-ones mask = full admin. IoC: `login failure for user -2 via ssh` then `user added by ssh:-2@…` PoC: https://github.com/digiprosec/MicroTrick Writeup: https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/ Patch: 7.23.4 / 7.24.2 / 6.49.21 - then hunt `ops` + Flagged. #MikroTik #RouterOS #CVE #PoC #InfoSec #CyberSecurity
Post summary
Public PoC and detailed technical writeup exist for a MikroTik RouterOS SSH auth-bypass chain (CVE-2026-67279 + CVE-2026-86060), newly added to CISA KEV; specific patched versions (7.23.4/7.24.2/6.49.21) are provided.
13121751742240.0K
2.3K followersView on X
YogSotho@YogSoth043d
Exploit
🧨🧨🧨 MIKROTRICK 🧨🧨🧨 Weaponized MikroTik RouterOS exploitation framework. - CVE-2026-67279 - CVE-2026-86060 - CVE-2026-67276 - CVE-2026-67281 - CVE-2026-67277 - CVE-2026-67278 - CVE-2025-61481 - CVE-2025-10948 - CVE-2018-14847 Now available at my beloved ❤️ https://gibliz.taile5d4a8.ts.net/0days/ #exploit #rce #vulnerabilities #cve #0days #mikrotik #router #cybersecurity #infosec #antisec #linux
Post summary
The post announces a publicly available, weaponized MikroTik RouterOS exploitation framework for multiple CVEs, providing exploit code but offering no patches, technical details, or evidence of in‑the‑wild use.
720277765.2K
2.0K followersView on X
Tolmo@TolmoHQ45d
PoC
It took us 3 hours to rewrite the full pre-auth RCE MikroTrick chain (CVE-2026-67279, CVE-2026-86060, CVE-2026-67276) from the public advisory. https://open.substack.com/pub/tolmo/p/pre-auth-rce-on-mikrotik-exploited?r=9tyic&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true
Post summary
The author indicates they have re‑implemented the full pre‑authentication RCE chain for MikroTik, suggesting a proof‑of‑concept exists, but no evidence of active exploitation or patching is mentioned.
518246286.6K
281 followersView on X
DMNTR Network Solutions 👻 AS204773@weareDMNTRs44d
Disclosure
- CVE-2026-86060 — Escalada de privilegios vía manejo de argumentos en el proceso de login SSH (sesión SSH no autenticada). - CVE-2026-67281 — Lectura de ficheros sin autenticación en WebFig (/jsproxy), con posible exposición de ficheros de configuración y credenciales. - CVE-2026-67279 — Ejecución de peticiones exec por SSH sin autenticación previa, permitiendo creación y sobrescritura de ficheros gestionados por RouterOS. - CVE-2026-67278 — Aceptación de firmas RSA/PKCS#1 v1.5 malformadas en la validación X.509, habilitando suplantación de servidores TLS. - CVE-2026-67277 — Sesiones btest "related" sin autenticación completada, con fuga de memoria de buffers de kernel y posible reinicio del equipo (denegación de servicio). - CVE-2026-67276 — Comparación incompleta de clave pública RSA en autenticación SSH, permitiendo autenticarse como un usuario autorizado sin disponer de su clave privada.
Post summary
The text lists several 2026 CVEs with descriptive technical details, but provides no exploit code, patches, or evidence of active exploitation.
513061124.7K
25.9K followersView on X
CISA Cyber@CISACyber26d
Active Exploitation
🛡️We added Microsoft SharePoint vulnerability CVE-2026-65660 & Mikrotik RouterOS vulnerability CVE-2026-67279 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/guGyzPoPIm
Post summary
The post announces CVE-2026-65660 and CVE-2026-67279 added to CISA's KEV catalog, signaling confirmed active exploitation, and urges organizations to apply mitigations.
51724079.5K
303.4K followersView on X
Dark Web Intelligence@DailyDarkWeb28d
Active Exploitation
🚨 MIKROTIK “MIKROTRICK”: UNAUTH SSH CHAIN TO FULL ADMIN — EXPLOITED BEFORE PATCHES CERT Polska published a 22 Sep 2026 technical analysis of MikroTrick, the unauthenticated MikroTik RouterOS SSH takeover chain combining CVE-2026-67279 (rekey state-machine flaw) with CVE-2026-86060 (username “-2” / login argv injection) for full admin without password or SSH key. • Patches: RouterOS 6.49.21, 7.23.4, 7.24.2, 7.25beta3 (vendor released ~3 Sep 2026) • CERT Polska says logs matching the chain (failed login for user -2, privileged “ops” account) appeared as early as 2 Sep — before patches • Distinctive IoCs: login failure for user -2; creation of fully privileged ops; connections from 82.192.72.4 in public reports; Flagged/device-mode checks after update • CVE-2026-86060 added to CISA KEV (10 Sep) with short remediation window • CERT incorrectly notes some coverage mixed in CVE-2026-67276 (separate RSA-forge path) — MikroTrick is the 67279+86060 pair • Immediate: patch, restrict public SSH, hunt -2 / ops / unknown config changes per MikroTik security bulletin ⚠️ Analyst Note: Primary is CERT Polska’s own technical write-up (not The Hacker News / Telegram CTI). Exploitation evidence is from CERT coordination plus public admin logs; treat as confirmed vulnerable-device attacks against internet-exposed SSH, not a new zero-day today. We assess MikroTrick as a confirmed, previously exploited RouterOS admin-takeover chain — patch and hunt now if not already done. Primary (CERT Polska, 22 Sep 2026): https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/ Also: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ #DDW #MikroTik #MikroTrick #RouterOS #KEV #ThreatIntelligence #CyberSecurity
Post summary
The MikroTik RouterOS SSH chain (CVE-2026-67279 + CVE-2026-86060) was exploited before patches, with CERT Polska confirming in-the-wild attacks via logs and CISA KEV entry; patches are now available and urgent mitigation is advised.
45132177.2K
209.0K followersView on X
Rıdvan Yağlı@ridvanyagli25d
Active Exploitation
🔴 MikroTik RouterOS için MicroTrick PoC yayınlandı. CVE-2026-86060 (CVSS 9.2 Critical) + CVE-2026-67279 (CVSS 6.9) zinciri, kimlik doğrulaması olmadan tam yönetici yetkisine ulaşılmasını sağlıyor. PoC; SSH üzerinden -2 kullanıcı adı, pre-auth rekey ve login helper'daki dosya descriptor/policy maskesi hatalarını zincirleyerek RouterOS üzerinde yetkili oturum elde ediyor ve yüksek yetkili hesap oluşturabiliyor. 🔴 Etkilenen: • RouterOS 6.0–6.49.20 • RouterOS 7.0–7.23.3 • RouterOS 7.24–7.24.1 ✅ Düzeltilen: • 6.49.21 • 7.23.4 • 7.24.2 • 7.25beta3 ⚠️ Zincirin gerçek saldırılarda aktif olarak kullanıldığı CERT Polska tarafından bildirildi. İnternete açık MikroTik SSH servisleri özellikle kontrol edilmeli. https://github.com/digiprosec/MicroTrick
Post summary
A newly released MicroTrick PoC exploits a two‑CVE chain in MikroTik RouterOS to achieve unauthenticated admin access, and CERT Polska reports it is already being used in the wild; patched versions are available.
120107786
2.5K followersView on X
Dark Web Intelligence@DailyDarkWeb23d
Active Exploitation
🚨 CISA: WORDPRESS CORE FLAW CVE-2026-87902 NOW EXPLOITED IN THE WILD CISA has added CVE-2026-87902, a WordPress Core remote file inclusion vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The same KEV update also added MikroTik RouterOS CVE-2026-67279. What the official WordPress advisory (GHSA-7hp8-65ch-5whp, rated Critical, CVSS 4.0 score 9.2) says: • Unauthenticated path traversal in page-template resolution lets an attacker make WordPress include a chosen local .php file outside the theme directories • Can lead to remote code execution when conditions are met: the active theme has a top-level "page-*" directory (Twenty Twelve, Twenty Fourteen and popular themes such as Neve, Hestia and Sydney), plus a usable local PHP file such as pearcmd.php with register_argc_argv enabled • The official php Docker image and default cPanel setups on PHP versions before 8.5 are affected • Fixed in WordPress 7.1.2, with backports to every branch down to 4.7 (e.g. 7.0.6, 6.9.9, 6.8.10) • Federal KEV remediation deadline: Sep 28, 2026 ⚠️ Analyst Note: WordPress runs a huge share of the web, and auto-updates do not cover every site. Confirm that the installed core version is patched, not just that auto-update is switched on, and review theme directories and PHP settings on shared hosting. Treat unpatched sites that meet these conditions as potentially compromised. CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog WordPress advisory: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp #DDW #DarkWeb #WordPress #CISA #KEV #CVE202687902 #Vulnerability #ThreatIntelligence #CyberSecurity
Post summary
CISA has added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog due to active exploitation of a critical WordPress Core remote file inclusion flaw; patched versions are available across all supported branches.
111946.3K
208.5K followersView on X
CCB Alert@CCBalert23d
Active Exploitation
Warning: Critical MikroTik RouterOS flaws are under active exploitation. CERT Polska reports CVE-2026-67279 + CVE-2026-86060 can enable unauthenticated full router takeover. #Patch #Patch #Patch
Post summary
The text reports active exploitation of MikroTik RouterOS vulnerabilities (CVE-2026-67279, CVE-2026-86060) by CERT Polska, emphasizing unauthenticated full router takeover capabilities. No specific exploit tools or patches are mentioned.
22012547
7.3K followersView on X
Pruva@pruvadev44d
PoC
MikroTik RouterOS CVE-2026-67279 + CVE-2026-86060, #pruva reproduced the chain: 1. CVE-2026-67279 provided the unauthenticated SSH session/exec path. 2. CVE-2026-86060 used the -2 identity/trusted-field behavior to obtain privileged RouterOS operations. https://www.pruva.dev/reproductions/REPRO-2026-00344
Post summary
The post announces a researcher reproduction of a MikroTik RouterOS privilege escalation chain involving CVE-2026-67279 and CVE-2026-86060, providing technical details and linking to the reproduction without mentioning patches or active exploitation.
111401.4K
83 followersView on X
Oscar🇩🇴@CCNADailyTIPS25d
PoC
@0xManan POC Video here: Millions of Routers EXPOSED! MikroTik Full Exploit Explained & Lab Tested (CVE-2026-67279 PoC) https://youtu.be/qC7evOiFwE4
Post summary
The tweet promotes a video that demonstrates a proof‑of‑concept for CVE‑2026–6727‑1 affecting millions of MikroTik routers, showing how the vulnerability can be exploited.
00021405
2.8K followersView on X
SOCMinute@SOCMinute28d
Patch
Critical MikroTrick exploit (CVE-2026-67279 & CVE-2026-86060) lets attackers fully control MikroTik routers without credentials. Patch immediately or isolate affected devices. Follow SOC Minute for updates. #MikroTik #Vulnerability #CERTPolska https://t.co/NwZHGLjjze
Post summary
The post highlights two critical MikroTik vulnerabilities (CVE‑2026‑67279 & CVE‑2026‑86060) that enable full router control without credentials and urges immediate patching or isolation as the primary remediation.
1002056
20 followersView on X
Threat Landscape@LandscapeThreat33d
Active Exploitation
Attackers exploited a two-vulnerability chain in internet-exposed MikroTik RouterOS devices to obtain unauthenticated administrative access. CVE-2026-67279 bypassed authentication through SSH rekeying, while CVE-2026-86060 converted attacker-controlled username input into a trusted administrative identity on vulnerable 7.x builds. Bishop Fox reproduced the takeover and found persistent unauthorized accounts, scripts, and daily scheduled tasks on compromised routers, despite volatile login logs having disappeared. Updates prevent further exploitation but do not remove existing access; defenders should inspect privileged users, configuration history, scripts, schedulers, and other persistence, then rebuild from a trusted baseline and rotate exposed secrets. Fixed releases include RouterOS 6.49.21, 7.23.4, and 7.24.2 or later, as applicable. More: http://threatlandscape.io
Post summary
A two-vulnerability chain (CVE-2026-67279 and CVE-2026-86060) was actively exploited against internet-exposed MikroTik RouterOS devices to gain unauthenticated administrative access and establish persistence via unauthorized accounts, scripts, and scheduled tasks; patches are available in RouterOS 6.49.21, 7.23.4, and 7.24.2+.
0003078
132 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-67279 RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to … https://www.cve.org/CVERecord?id=CVE-2026-67279
Post summary
The post announces a RouterOS SSH flaw where a rekey request allows an unauthenticated client to exploit the system before authentication is attempted.
000211.6K
58.1K followersView on X
Bhavesh Verma@xbhaveshverma17d
Active Exploitation
MikroTik RouterOS "MikroTrick" Attack Chain Grants Full Admin Access Without a Password, and CISA Set a Three-Day Federal Deadline. The MikroTrick attack chain exploits CVE-2026-67279 (CVSS 6.9), a pre-authentication flow bypass in RouterOS SSH, chained with CVE-2026-86060, a parameter injection vulnerability in the login process. Together, they allow an unauthenticated attacker to gain full administrative control of internet-exposed RouterOS devices without a password. CERT Polska has observed active exploitation since September 2, and Bishop Fox researchers reproduced the full takeover on RouterOS 7.x. CISA added the vulnerabilities to its KEV catalog with federal remediation deadlines of September 28. MikroTik routers are widely deployed in small and medium businesses, ISPs, and branch offices, often with default credentials and outdated firmware. A compromised router is a silent pivot point for every device behind it, and most organizations don't even know these devices are on their network.
Post summary
The text describes the MikroTrick attack chain chaining CVE-2026-67279 and CVE-2026-86060 for unauthenticated RouterOS admin access, and reports that CERT Polska observed active exploitation since September 2 with CISA listing the vulnerabilities in its KEV catalog.
00110116
453 followersView on X
Anthony Bahn@HoustonIntrove123d
Patch
CISA's MikroTik clock runs out today. CVE-2026-67279 opens exec over SSH with no login, then the chain finishes as admin. I'm pulling every internet-facing RouterOS we still own to 6.49.21, 7.23.4, or 7.24.2, then checking logs for user -2. https://www.securityweek.com/mikrotik-patches-critical-flaws-chained-to-hack-routers/
Post summary
The post discloses CVE-2026-67279 technical details (SSH exec without login, chain to admin) and explicitly urges upgrading to fixed RouterOS versions (6.49.21, 7.23.4, 7.24.2), classifying it as a Patch-type advisory.
2000049
44 followersView on X
SHELLCODE@sh3ll_c0d324d
Disclosure
💥 MIKROTRICK: Full Root on MikroTik Routers! 🔓⚡ Attackers chain SSH rekeying (CVE-2026-67279) with argument injection (CVE-2026-86060) to seize edge routers. 👉 Full analysis: https://sh3llc0d3.com/blog/mikrotrick-exploit-chain-chaining-ssh-rekeying-with-argument-injection-for-full-mikrotik-router-control-cve-2026-67279-cve-2026-86060/ #sh3llc0d3 #shellcode #MikroTik #RouterOS #RCE
Post summary
The tweet announces a new exploit chain targeting MikroTik routers, detailing two chained vulnerabilities (CVE-2026-67279 and CVE-2026-86060) that lead to full root compromise, and directs readers to a full technical analysis.
1100094
108 followersView on X
General Intels Daily@intels_daily25d
Active Exploitation
🟠 𝗛𝗜𝗚𝗛 · 𝗗𝗶𝘀𝗰𝘂𝘀𝘀𝗶𝗼𝗻 🧩 Products: 𝗪𝗦𝗢𝟮 𝗔𝗣𝗜 𝗠𝗮𝗻𝗮𝗴𝗲𝗿, 𝗔𝗱𝗼𝗯𝗲 𝗖𝗼𝗺𝗺𝗲𝗿𝗰𝗲, 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗦𝗵𝗮𝗿𝗲𝗣𝗼𝗶𝗻𝘁 🛡️ CVE-2026-5430, CVE-2026-71362 The post reports on a CISA advisory regarding active exploitation of critical vulnerabilities in WSO2 API Manager (CVE-2026-5430), Adobe Commerce (CVE-2026-71362), Microsoft SharePoint (CVE-2026-65660), and Mikrotik RouterOS (CVE-2026-67279). #ThreatIntel #CTI
Post summary
The tweet highlights a CISA advisory confirming active exploitation of critical CVEs in WSO2, Adobe, Microsoft, and Mikrotik products, with no mitigation steps or exploit tools specified.
10010181
755 followersView on X
Prateek Tomar@Prateektomar26d
Active Exploitation
MikroTik MikroTrick update: CISA has added CVE-2026-67279 to KEV. The RouterOS SSH flaw can be chained with CVE-2026-86060 for unauthenticated exploitation. Update immediately, restrict management access and inspect configurations. https://mikrotik.com/supportsec/september-2026-vulnerability/
Post summary
CISA has added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog, confirming active exploitation, and the text urges immediate updating and access restrictions for the RouterOS SSH flaw.
2000059
135 followersView on X
PCMedicalist@PCMedicalist26d
Patch
🔐 Daily Security & Standards Brief (Sep 25) CVE-2026-67279--Mikrotik RouterOS: patch Mikrotik RouterOS and verify the fix held. Full digest 👇 via PCMedicalist #CyberSecurity #InfoSec https://t.co/xkGd28tabu
Post summary
The brief highlights CVE-2026-67279 in MikroTik RouterOS and explicitly instructs users to apply the patch and verify the fix.
0002053
192 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	mikrotik	routeros	-	-	-

Explore more

Back to dashboard mikrotik CVEs routeros vulnerabilities

What researchers are saying

CVE-2026-67279

!Manan[verified]@0xMananActive Exploitation

Public PoC and detailed technical writeup exist for a MikroTik RouterOS SSH auth-bypass chain (CVE-2026-67279 + CVE-2026-86060), newly added to CISA KEV; specific patched versions (7.23.4/7.24.2/6.49.21) are provided.

YogSotho[verified]@YogSoth0Exploit

The post announces a publicly available, weaponized MikroTik RouterOS exploitation framework for multiple CVEs, providing exploit code but offering no patches, technical details, or evidence of in‑the‑wild use.

Tolmo[verified]@TolmoHQPoC

The author indicates they have re‑implemented the full pre‑authentication RCE chain for MikroTik, suggesting a proof‑of‑concept exists, but no evidence of active exploitation or patching is mentioned.

DMNTR Network Solutions 👻 AS204773[verified]@weareDMNTRsDisclosure

The text lists several 2026 CVEs with descriptive technical details, but provides no exploit code, patches, or evidence of active exploitation.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

The MikroTik RouterOS SSH chain (CVE-2026-67279 + CVE-2026-86060) was exploited before patches, with CERT Polska confirming in-the-wild attacks via logs and CISA KEV entry; patches are now available and urgent mitigation is advised.

Rıdvan Yağlı[verified]@ridvanyagliActive Exploitation

A newly released MicroTrick PoC exploits a two‑CVE chain in MikroTik RouterOS to achieve unauthenticated admin access, and CERT Polska reports it is already being used in the wild; patched versions are available.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

CISA has added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog due to active exploitation of a critical WordPress Core remote file inclusion flaw; patched versions are available across all supported branches.

SOCMinute[verified]@SOCMinutePatch

The post highlights two critical MikroTik vulnerabilities (CVE‑2026‑67279 & CVE‑2026‑86060) that enable full router control without credentials and urges immediate patching or isolation as the primary remediation.