Inside the MikroTik September 2026 Release: Three RouterOS Flaws, One Patch Cycle

MikroTik's September 2026 security update addresses three critical vulnerabilities in its RouterOS operating system, classified as CRITICAL by CERT-In with identifier CIVN-2026-0460. These bugs present attack vectors that begin before login and extend afterward.

The first flaw, CVE-2026-67276, involves an incomplete check of RSA public keys during Secure Shell (SSH) authentication. A malicious actor could send a maliciously constructed SSH public-key authentication request with a falsified RSA key and signature. Due to the inadequate verification process, the login would succeed without valid credentials, potentially granting the attacker full administrative control. No existing account is necessary; only network access to the SSH service on the affected device is required.

The second flaw, CVE-2026-86060, relates to privilege escalation after a successful login. By sending a carefully crafted username or command argument over an accessible SSH login session, an attacker can manipulate the RouterOS policy mask and elevate privileges. Following this privilege escalation, the compromised router can then be used to access internal systems.

The third vulnerability, CVE-2026-67277, exists within the bandwidth-test (btest) service, which does not perform authentication checks. By sending specific network requests to an exposed btest service, an attacker could read portions of uninitialized kernel memory and potentially crash or restart the router. The impacted RouterOS versions include releases 7.24 and earlier than 7.24.2, 7.0.0 and earlier than 7.23.4, and 6.0.0 and before 6.49.21.

To mitigate these risks, users should apply the patched releases outlined in MikroTik's September 2026 advisory. In the interim, it is recommended to restrict SSH access to trusted sources, disable the btest service where not required, and monitor for any suspicious administrative logins.