CVE-2026-67279

{
  "etk_id": "ETK-2026-8",
  "cve_id": "CVE-2026-67279",
  "display_id": "CVE-2026-67279",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-72027",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SSH authentication bypass in MikroTik RouterOS",
  "summary": "Affected RouterOS SSH services can accept command requests from an unauthenticated remote client. An attacker who can reach the SSH service may manipulate files in the RouterOS managed file namespace, including configuration or diagnostic support data.",
  "mitigation": "Upgrade RouterOS to 6.49.21, 7.23.4, or 7.24.2, or a later release on the applicable maintenance track. Until upgrades are complete, restrict SSH access to trusted administrative networks.",
  "vendor": "MikroTik",
  "product": "RouterOS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.24, < 7.24.2",
        ">= 7.0.0, < 7.23.4",
        ">= 6.0.0, < 6.49.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.24.2",
        "7.23.4",
        "6.49.21"
      ],
      "package_name": "RouterOS",
      "purl": null
    }
  ],
  "cwes": [
    841
  ],
  "cvss_score": 6.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss_score": 0.0103,
  "epss_percentile": 0.6326,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.635611233333332,
  "t0_at": "2026-09-05T20:00:57.894000+00:00",
  "signals": {
    "kev": {
      "at": "2026-09-05T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-05T20:00:57.894000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-67279"
    },
    "public_poc": {
      "at": "2026-09-25T15:59:34+00:00",
      "days": 19.832362337962962,
      "is_lower_bound": false,
      "measured_at": "2026-09-05T20:00:57.894000+00:00",
      "url": "https://github.com/gagaltotal/CVE-2026-mikrotik-poc"
    },
    "trigger_signal": {
      "at": "2026-09-25T00:00:00+00:00",
      "days": 19.16599659722222,
      "is_lower_bound": false,
      "measured_at": "2026-09-05T20:00:57.894000+00:00",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279"
    }
  }
}