Third MikroTik CVE hits KEV: verify your router build

CISA added a third MikroTik RouterOS flaw to the Known Exploited Vulnerabilities catalog today, and the remediation deadline is Monday. CVE-2026-67279 went into the KEV catalog on September 25 with a due date of September 28 — a three-day federal clock, which is as short as CISA sets them. The interesting part for everyone else: the patch that fixes it shipped on September 5. If you have a MikroTik between your office and the internet, today's job is not patching. It is proving you already did.

What actually happened

CVE-2026-67279 is one of the six RouterOS flaws CERT Polska disclosed at the start of September, alongside the two that chain into the MikroTrick takeover. It is an SSH state-machine bug: RouterOS enters the connection protocol after a client-requested rekey even though user authentication was never attempted. An unauthenticated client can open a session channel and send an exec request. The server runs it.

The practical effect is write access to the RouterOS managed file namespace without credentials — creating, overwriting and reconstructing files, including the support files that carry configuration and diagnostic data. No login, no password spray, no chain.

MikroTik fixed it in 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable) — the same builds that closed CVE-2026-67276, CVE-2026-67277, CVE-2026-67281 and CVE-2026-86060. Two of those, CVE-2026-86060 and CVE-2026-67277, went into KEV on September 10 with a September 13 deadline. Today's entry is the third MikroTik CVE in the catalog this month.

One version number does not line up with the rest. CVE-2026-67278, a malformed RSA/PKCS#1 signature acceptance bug from the same advisory, is not fixed until 7.23.6 or 7.24.3. A device sitting on 7.23.4 is clear of today's KEV entry and still exposed to that one.

Why patch verification matters for your business

"We patched it" and "it is patched" are different claims. A router that got a firmware upload three weeks ago may have downloaded the package and never rebooted into it. RouterOS applies upgrades on restart. Run /system package update print and /system resource print on every device and read the version back. If you manage more than three of these, script it and keep the output — that file is your answer when a client or an insurer asks.

Edge hardware is the thing nobody owns. Servers have an owner. Laptops have an owner. The router in the closet was installed by a contractor in 2019 and has been fine ever since, which is exactly why it is running 6.48. Every small business we audit has at least one device in that category. Put a name against each one this week.

SSH on the WAN is the precondition for all of this. These flaws are reachable because the SSH service answers from the internet. It almost never needs to. Bind management services to the LAN or a VPN interface, or restrict them by source address list. That one change neutralizes an entire class of RouterOS advisories you have not read yet.

Treat a three-day KEV deadline as a signal, not a federal formality. CISA sets short due dates when exploitation is active and the payoff is high. The federal mandate binds agencies; the exploitation does not care who you are. A three-day clock on a network edge device means someone is already scanning for it.

Sources: CISA Known Exploited Vulnerabilities Catalog, CERT Polska.