Patching Guide: Closing the CVE-2026-67276 SSH Authentication Bypass on MikroTik Routers
CERT-In rated CIVN-2026-0460 CRITICAL, and the reason is easy to state: CVE-2026-67276 lets a forged RSA public key and signature through SSH authentication, potentially handing the attacker full administrative control of the router. This guide condenses the advisory into the actions administrators should take.
Step 1: identify affected devices
The flaw affects MikroTik RouterOS in three ranges:
- 7.24 and versions before 7.24.2
- versions from 7.0.0 before 7.23.4
- versions from 6.0.0 before 6.49.21 Inventory devices against those ranges. To size the external exposure of RouterOS assets in general, the verified ZoomEye query os="RouterOS" returned 8,085,078 matching assets on September 18, 2026 — an industry-wide surface indicator, not a list of confirmed vulnerable devices.
Step 2: upgrade
MikroTik's September 2026 advisory lists the fixed releases. Upgrade to 7.24.2, 7.23.4 or 6.49.21 (or later) as each device's train allows. The same release cycle fixes two companion flaws: CVE-2026-86060, a privilege escalation via crafted argument delimiters in the SSH login path, and CVE-2026-67277, a denial-of-service and kernel-memory disclosure in the unauthenticated bandwidth-test service.
Step 3: reduce exposure while patching
- Restrict SSH to a dedicated management network or trusted source addresses.
- Disable the SSH service on devices that do not need it.
- Disable or firewall the btest service where bandwidth testing is unused.
- Log administrative logins and alert on unexpected success from unusual sources.
Why speed matters
The authentication bypass requires no credentials, so a device whose SSH port is reachable before it is patched is at risk for the whole window. CERT-In's note lists no workaround substitutes for the update; upgrading remains the definitive fix.
Sources
- CERT-In Vulnerability Note CIVN-2026-0460 (September 16, 2026)
- MikroTik advisory: https://mikrotik.com/supportsec/september-2026-vulnerability/
