MikroTik RouterOS Security Advisory (CVE-2026-67276/86969/67277)

September 2026 Vulnerability Vulnerability Overview A security vulnerability has been identified in RouterOS, and a release containing the fix has been published. This is a significant security update. Most configurations are unaffected, but upgrading is strongly recommended. To allow time for system updates, detailed technical information has not yet been disclosed. Devices should already offer the software upgrade option in the “Check for updates” menu. Affected Versions The fix is included in the following versions: - 7.25 beta 3 - 7.24.2 - 7.23.4 - 6.49.21 For typical home users, this issue does not pose an immediate risk, but it is still recommended that all users upgrade. Resolution / Mitigation 1. SSH Port Management: Ensure that SSH is not exposed to untrusted networks. MikroTik’s default configuration blocks access to this port from the internet; if manually opened, restrict access to trusted IPs only, or better yet, use a strong VPN (such as WireGuard) to access the router and leave no management ports open. 2. Flagged Status Check: RouterOS checks whether a device has been compromised and marks it as “Flagged” if it has been. If a Flagged status appears in the logs, refer to the instructions on the Flagged Status documentation page. 3. Post-Upgrade Check: Even if the device is not in a Flagged state, after upgrading RouterOS, you should check the device configuration for any unknown scripts, users, or other unfamiliar configurations. More Information Detailed technical information can be found under the issue code “MikroTrick” and CVE identifiers CVE-2026-67276, CVE-2026-86969, CVE-2026-67277 (originally reported by CERT.pl). This article will be updated with supplementary information at the appropriate time. Contact Contact email for vulnerability-related inquiries: security@mikrotik.com > Note: The page does not include a POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

MikroTik RouterOS Security Advisory (CVE-2026-67276/86969/67277)