CVE-2026-67278

Think of your router as a security guard checking ID badges before letting secure connections through. This flaw means the guard can be fooled by a cleverly forged badge, letting an attacker pretend to be a trusted website or server the router is talking to. That could let someone quietly intercept or tamper with what looks like a secure connection.

This matters to you if you run any Mikrotik router on the RouterOS 7.x branch, especially if it makes outbound TLS or SSH connections to other servers (common in VPNs, update checks, or remote management). No login or user interaction is needed for an attacker to exploit it — the risk comes from the router itself initiating connections that can be redirected or intercepted.

This is a critical-severity flaw that lets an attacker impersonate trusted servers without needing any credentials, and earlier patch attempts (7.23.4 and 7.24.2) failed to fully close the hole — meaning some already-patched routers may still be exposed. While no confirmed real-world attacks or public exploit code exist yet, the ease of exploitation and router's internet-facing role mean this should be treated as a priority, not deferred.

Confirm exposure by checking the RouterOS version on each device (System > Resources or /system resource print via CLI). Any 7.x release before 7.23.6 (Long-term branch) or 7.24.3 (Stable branch) is vulnerable; critically, 7.23.4 and 7.24.2 contain an incomplete fix and must not be treated as remediated. Upgrade to 7.23.6 or later on the LTS track, or 7.24.3 or later on the Stable track. Review Mikrotik's September 2026 security advisory for branch-specific upgrade notes and any breaking changes before rolling out to production routers. If immediate patching isn't possible, consult the CERT.PL workaround advisory for interim mitigations (e.g., restricting outbound TLS/SSH to trusted endpoints, disabling unnecessary RSA-based verification paths where feasible). No CISA KEV listing exists currently, so there is no federal remediation deadline, but given the critical CVSS score and incomplete prior patches, treat this as a near-term priority. Monitor Mikrotik's advisory page and CERT.PL for updates, and watch for any shift from predicted to confirmed exploitation.

CVSS 9.1 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-exploitable, no privileges or user interaction required, with high confidentiality and integrity impact but no availability impact. Weakness is CWE-347 (Improper Verification of Cryptographic Signature): RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures and trusts an e=3 root CA, enabling signature forgery without the corresponding private key across both TLS/X.509 validation and SSH host-key authentication. Not listed in CISA KEV; no public exploit code is known to exist. EPSS prediction is low with a flat trend. Prior partial fixes (7.23.4, 7.24.2) did not fully resolve the issue — full remediation requires 7.23.6 (LTS) or 7.24.3 (Stable). Press attention is rising per PULSE (roundup coverage referencing actor 'DataSuckers'), but this reflects media interest, not confirmed exploitation.