MikroTik RouterOS CVE-2026-67276: Forged RSA Keys Can Bypass SSH Authentication

MikroTik RouterOS is facing a critical security vulnerability, CVE-2026-67276, which can allow attackers to bypass SSH authentication by forging RSA keys. CERT-In issued a security advisory on September 16, 2026, rating the flaw as critical. The vulnerability lies in RouterOS's incomplete verification of RSA public keys during SSH authentication.

An attacker can exploit this by sending a crafted public-key authentication request with a forged RSA key and signature, which the router accepts. This bypass of authentication could potentially grant the attacker full administrative control over the device. To mitigate the risk, administrators are advised to upgrade RouterOS to version 7.24.2, 7.23.4, or 6.49.21 or later.

As an interim measure, restricting SSH access to trusted hosts, disabling the SSH service when not in use, and implementing firewall rules for the management plane can also help. The vulnerability also affects RouterOS versions 7.0.0 through 7.23.3 and 6.0.0 through 6.49.20. In addition to CVE-2026-67276, the fix in this release addresses two other vulnerabilities, CVE-2026-86060 and CVE-2026-67277.