ZeroDayAlert

CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

MikroTik RouterOS Added to KEV 2026-09-25 Federal due 2026-09-28 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

MikroTik RouterOS is affected by an improper enforcement of behavioral workflow vulnerability. The flaw allows an unauthenticated client to open a session channel and send an exec request. The record does not specify which versions of RouterOS are vulnerable, nor does it detail the scope of deployment models (cloud-hosted, on-premises, or both).

How to check whether this touches you

  • Inventory all MikroTik RouterOS appliances and instances you operate or depend upon, including those managed by third parties on your behalf.
  • Determine whether each RouterOS instance is reachable over a network from outside your organisation, or from untrusted internal segments.
  • Query the running RouterOS version via SSH, the web interface, or API; note that version numbers alone do not confirm whether a backported patch has been applied, so cross-reference with MikroTik's advisory for your release line.
  • If you lack direct access to RouterOS instances (for example, if a managed service provider operates them), request confirmation of patch status and exposure from the provider directly.

What to do

  1. Check MikroTik's official security advisory and vendor guidance for the specific patch or workaround applicable to your RouterOS version.
  2. If your RouterOS instance is internet-reachable and you cannot patch immediately, restrict network access to the management interfaces (SSH, web UI, API) using firewall rules or access control lists; log all connection attempts to these interfaces.
  3. Apply the vendor-supplied remediation as soon as operationally feasible, prioritising internet-exposed and critical infrastructure instances in line with CISA BOD 26-04 guidance.
  4. If the vendor provides no patch or workaround, or if patching is not technically feasible, escalate to your risk and compliance teams to determine whether continued use of the product is acceptable.
  5. Enable and centralise logging of session openings, exec requests, and authentication failures on RouterOS; retain logs for forensic review.

If you find you were exposed

Exploitation of this vulnerability typically precedes public disclosure, so you should search RouterOS logs for unauthenticated session initiations and exec requests dating back several months. Pay particular attention to sessions opened without login credentials or from unexpected source addresses. If your log retention window is shorter than three months, note this gap and extend retention prospectively. Coordinate with your security team to determine whether further investigation or threat-hunting is warranted based on the time the vulnerability was likely active in your environment.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-67279 is being exploited. It cannot tell you whether RouterOS is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →