SSH user impersonation possible in Mikrotik RouterOS
Mikrotik · RouterOS
Mikrotik RouterOS fails to compare the complete RSA public key during SSH authentication, allowing an attacker who knows an authorized RSA modulus to forge a signature and open an SSH command channel as the target user without the private key. This affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
- Public exploit codePoC-in-GitHub+1 day
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 7 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- MikroTrick: MikroTik RouterOS Unauth SSH Admin Takeover (CVE-2026-67279 + CVE-2026-86060)30 Sep 2026
- CISA KEV: SharePoint CVE-2026-65660 RCE + MikroTrick RouterOS Chain27 Sep 2026
- MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key23 Sep 2026
- CVE-2026-75650: Adobe Patches Actively Exploited Magento Zero-Day Used to Deploy Backdoors8 Sep 2026
- ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More7 Sep 2026
- CVE-2026-67276: MikroTik RouterOS SSH Zero-Day Exploited in Router Takeover Attacks7 Sep 2026
- 1 more on OTX