MikroTik RouterOS SSH & Unauth File Read CVEs (2026)

MikroTik RouterOS Software Vulnerability Summary Vulnerability Overview CERT Polska identified a series of vulnerabilities in the MikroTik RouterOS software and participated in the coordinated disclosure. These vulnerabilities primarily involve: CVE-2026-67276: During SSH authentication, when a public key matches, RouterOS does not properly verify the cryptographic signature (CWE-347). CVE-2026-67277: RouterOS accepts "leader" tree connections before the client completes RSA public key verification, allowing unauthenticated clients to initiate IPv4 UDP sessions. CVE-2026-67278: RouterOS accepts malformed RSA/PCRE signatures, allowing attackers to forge internal certificates to enable TLS server interception. CVE-2026-67279: RouterOS enters the SSH connection protocol after the client requests re-negotiation, allowing unauthenticated clients to open session channels and send exec requests. CVE-2026-67281: An unauthenticated file read vulnerability exists in the RouterOS Web interface, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67282: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67283: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67284: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67285: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67286: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67287: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67288: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67289: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67290: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67291: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67292: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67293: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67294: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67295: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67296: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67297: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67298: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67299: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. CVE-2026-67300: RouterOS is susceptible to an unauthenticated file read vulnerability, allowing attackers to read files containing configuration and diagnostic data. Impact Scope Affected Versions: - Versions prior to 7.24 - Versions prior to 7.24.2 - Versions prior to 7.23.4 - Versions prior to 6.49.21 Remediation Upgrade to version 7.24 or higher Upgrade to version 7.24.2 or higher Upgrade to version 7.23.4 or higher Upgrade to version 6.49.21 or higher POC Code No POC or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

MikroTik RouterOS SSH & Unauth File Read CVEs (2026)