Exposure Check: Sizing the MikroTik RouterOS Fleet Before Attackers Do

When a CRITICAL authentication bypass lands for a widely deployed router platform, the first operational question is scale. CERT-In's note CIVN-2026-0460 (September 16, 2026) documents CVE-2026-67276 in MikroTik RouterOS: incomplete verification of RSA public keys during SSH authentication allows a forged key and signature to bypass login, potentially granting full administrative control.

What the internet-facing surface looks like

To measure how much RouterOS exists in the wild, a ZoomEye survey was run with the product operating-system query os="RouterOS" on September 18, 2026. It returned 8,085,078 matching assets. The count represents RouterOS assets indexed by the search engine; it does not confirm that any listed device runs an affected version or exposes SSH. A companion filter query, vul.cve="CVE-2026-67276", returned zero indexed assets, meaning the CVE is not yet mapped to indexed devices in that dataset.

Translating surface into risk

Three factors turn this exposure into concrete risk:

• The flaw is pre-authentication: forged RSA credentials are enough, so no password theft is required.
• SSH is routinely left reachable for administration, and the companion flaw CVE-2026-86060 raises privileges through crafted argument delimiters once any login path is reachable.
• The third flaw in the same advisory, CVE-2026-67277, lets unauthenticated requests to the bandwidth-test service leak kernel memory and crash devices.

Affected versions

RouterOS 7.24 and versions before 7.24.2, versions from 7.0.0 before 7.23.4, and versions from 6.0.0 before 6.49.21.

Actions

Upgrade to the fixed releases in MikroTik's September 2026 advisory, then shrink the reachable surface: filter SSH to trusted sources, disable btest where unused, and audit administrative access logs for anomalies.

Sources

• CERT-In Vulnerability Note CIVN-2026-0460 (September 16, 2026)
• MikroTik advisory: https://mikrotik.com/supportsec/september-2026-vulnerability/
• ZoomEye queries os="RouterOS" (8,085,078 assets) and vul.cve="CVE-2026-67276" (0), checked 2026-09-18