“RouterOS SSH public key authentication bypass vulnerability (CVE-2026-67276) exploitable in the wild”
2026-09-07 18:32Cybersecurity🔥 49.2 heat score
2sources
1days unfolding
49.2heat score
3mentions
SummaryAI generated
Hackers have exploited two vulnerabilities in MikroTik RouterOS (including CVE-2026-67276) to hijack devices that expose their SSH services to the internet. The vulnerability stems from the way SSH compares only the type and modulus of keys when matching public keys, ignoring the exponent part. Attackers can forge malicious public keys to bypass authentication and gain control of the devices. Qisanx CERT has detected that this vulnerability is being exploited in the wild, affecting RouterOS version 7.24. The total number of globally affected assets reaches 2,734,151. Currently, PoC and technical details have been made public, and a security patch has been released. It is recommended to update RouterOS 6.x (Long-term) to 6.49.21 or higher, 7.x (Long-term) to 7.23.4 or higher, and 7.x (Stable) to 7.24.2 or higher. Additionally, it is suggested to restrict SSH access to trusted IPs and regularly audit the list of SSH keys and monitor for any abnormalities…
Qianxin CERT has detected that the RouterOS SSH public key authentication bypass vulnerability (CVE-2026-67276) is being exploited in the wild. This vulnerability stems from the implementation of RouterOS SSH, which only compares the type and modulus of the key when matching the public key, ignoring the exponent part. An attacker can forge a malicious public key with an exponent of 1 to completely bypass authentication and gain device control rights without a private key. The PoC and technical details have been made public; the affected version includes RouterOS 7.24, and the total number of globally affected assets reaches 2,743,151. A security patch has been released; it is recommended to update RouterOS 6.x (Long-term) to 6.49.21 or higher, 7.x (Long-term) to 7.23.4 or higher, and 7.x (Stable) to 7.24.2 or higher. It is also recommended to limit SSH access to trusted IPs and regularly audit the SSH key list as well as monitor abnormal login activities.