CVE-2026-67279: Unauthenticated Mikrotik RouterOS Exec Request Vulnerability

Overview of CVE-2026-67279 in Mikrotik RouterOS

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert by adding CVE-2026-67279 to its Known Exploited Vulnerabilities (KEV) catalog. This designation confirms active, in-the-wild exploitation of a significant improper enforcement of behavioral workflow vulnerability affecting Mikrotik RouterOS. Network defenders managing Mikrotik infrastructure must prioritize immediate remediation efforts, as this flaw allows unauthenticated attackers to open a session channel and send exec requests, posing a severe risk to network integrity and security. The federal remediation due date for this vulnerability is 2026-09-28, according to CISA.

Technical Analysis: Unauthenticated Mikrotik RouterOS Exploitation

CVE-2026-67279 specifically addresses an improper enforcement of behavioral workflow within Mikrotik RouterOS. This weakness, categorized as CWE-841 (Improper Enforcement of a Behavioral Workflow), means that the system fails to correctly validate or control the sequence of operations an unauthenticated client can perform. Consequently, an attacker can bypass typical authentication mechanisms to establish a session channel. Once this channel is open, the attacker can then issue exec requests, potentially leading to arbitrary command execution or further malicious actions on the affected device.

The CISA advisory further highlights that this vulnerability can be chained with CVE-2026-86060 to achieve even broader unauthenticated exploitation. While the exact details of CVE-2026-86060 are not elaborated in the CISA KEV entry, the chaining potential indicates that CVE-2026-67279 acts as an initial access vector, enabling subsequent, potentially more severe, compromises without requiring any prior authentication. The inclusion in the KEV catalog on 2026-09-25 underscores that threat actors are actively leveraging this flaw, making it an immediate concern for any organization utilizing Mikrotik RouterOS devices.

The implication of unauthenticated exec request capability on network devices like routers is profound. These devices are often the perimeter defense, controlling network traffic and access. Compromise at this level can lead to network segmentation bypass, data exfiltration, denial-of-service, or the establishment of persistent backdoors within an organization’s infrastructure.

Mitigating Mikrotik RouterOS CVE-2026-67279 Unauthenticated Exploitation

Organizations with Mikrotik RouterOS devices must act promptly to address the risks posed by CVE-2026-67279. CISA’s guidance emphasizes adherence to several critical steps:

• Apply Vendor Mitigations: The primary and most urgent action is to apply all available patches and mitigations provided by Mikrotik. Organizations should consult official Mikrotik advisories for specific instructions pertaining to their RouterOS versions.
• CISA BOD 26-04 Compliance: Federal agencies and, by extension, all organizations committed to strong cybersecurity postures, must ensure compliance with CISA’s Binding Operational Directive (BOD) 26-04, “Prioritizing Security Updates Based on Risk.” This directive mandates timely patching of known exploited vulnerabilities. For cloud services utilizing Mikrotik RouterOS, specific BOD 26-04 guidance should be followed. If no mitigations are available from the vendor, organizations should consider discontinuing the use of the product to eliminate the risk.
• Evaluate Internet Exposure: Stakeholders are responsible for evaluating the internet exposure of each asset. Devices running Mikrotik RouterOS that are directly accessible from the internet present the highest risk and should be prioritized for patching or mitigation. Limiting exposure to management interfaces is a fundamental security practice.
• Implement Forensics Triage Requirements: Given confirmed exploitation, organizations should be prepared to conduct forensic analysis if compromise is suspected. CISA’s “Forensics Triage Requirements” provide a framework for incident response and data collection to aid in understanding the scope and nature of any potential breach.
• Network Segmentation and Monitoring: Implementing strong network segmentation can limit the lateral movement of attackers even if a perimeter device is compromised. Continuous monitoring for unusual traffic patterns or unauthorized exec requests on Mikrotik devices is also crucial for early detection of exploitation attempts.

Addressing this improper enforcement of behavioral workflow vulnerability requires a multi-faceted approach, combining immediate patching with proactive security management and incident response readiness. Organizations seeking to strengthen their CISA BOD 26-04 compliance for network devices should review their patching cycles and vulnerability management programs.

Related: CVE-2024-37014: CISA Orders Federal Agencies to Patch Langflow, CVE-2026-66384: JFrog Artifactory Path Traversal Exploit