Multiple Critical Vulnerabilities in MikroTik RouterOS Enable Admin Hijacking
What Happened — Researchers disclosed three CVEs (CVE‑2026‑67276, CVE‑2026‑86060, CVE‑2026‑67277) affecting MikroTik RouterOS versions prior to 7.25 beta3, 7.24.2, 7.23.4, and 6.49.21. The flaws allow an unauthenticated attacker to bypass SSH authentication or craft privileged sessions, potentially taking full administrative control of the router. Exploitation has already been observed in the wild.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a documented, continuously‑updated vulnerability‑management process that can surface and remediate critical flaws before they are weaponised.
- Provides a concrete example of why continuous evidence of patch status and configuration compliance is essential for audit readiness across multiple frameworks.
- Highlights the importance of automated control‑mapping and evidence collection to prove that remediation actions have been performed and verified.
Who Is Affected – Government agencies, large‑ and medium‑size enterprises, ISPs, and home users that run MikroTik routers with the affected RouterOS versions.
Recommended Actions
- Deploy the MikroTik stable‑channel firmware update that addresses the three CVEs after testing in a controlled environment.
- Formalise a vulnerability‑management program: inventory all network devices, track patch status, and schedule regular reviews.
- Integrate automated control‑mapping tools to capture firmware‑version evidence and generate audit‑ready reports.
Source: CIS Advisory 2026‑095
Technical Notes
- CVE‑2026‑67276: SSH authentication bypass via RSA modulus comparison.
- CVE‑2026‑86060: Username‑parsing flaw that grants full admin privileges.
- CVE‑2026‑67277: Bandwidth‑test service misuse leading to kernel memory exposure or device crash.
Source: CIS Advisory 2026‑095