vulnerability

CVE-2026-67276

· published 2026-09-05 · 1 on the wire

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

Exploited in the wild

Not on KEV

Not in CISA's Known Exploited Vulnerabilities catalogue as of the last daily pull. Absence is not proof of safety.

EPSS · 30-day forecast

Chance of exploitation in the next 30 days, 16th percentile of all CVEs. A forecast; KEV outranks it.

CVSS · NVD

—

no vector published

Internet exposure

197,794

MikroTik hosts Shodan could see worldwide on 2026-09-07. A scan count, not an inventory.

On the wire1

07 SepAttackers Exploited MikroTik RouterOS Flaws a Day Before Patches ShippedEXPL

References

Early access

Watch this one?

Early access opens alerts first — one email when a CVE you follow lands on KEV or an adversary you follow lands on the wire. Nothing else, ever.

bot-protected