RouterOS unauth file overwrite, exploited (CVE-2026-67279) [PoC]

Actively exploited in the wild - CVE-2026-67279 is a medium-severity authentication bypass in MikroTik RouterOS SSH that lets an unauthenticated client open a session channel and dispatch an exec request, allowing files in the RouterOS managed file namespace to be created, overwritten, or reconstructed. Patched in RouterOS 6.49.21, 7.23.4, and 7.24.2 - update immediately if you are running an affected build.

Overview

RouterOS SSH is supposed to require user authentication before a client can do anything useful. This vulnerability breaks that assumption. When a client requests a rekey during the SSH connection protocol, affected builds move into the connection phase even though the client never attempted to log in. From there, an unauthenticated attacker can open a session channel and send an exec request, and the server will actually dispatch the command.

That matters because RouterOS exposes a managed file namespace to SSH-driven tooling. An attacker who can run commands without authenticating can create, overwrite, or reconstruct files in that namespace, including support files that hold configuration and diagnostic data. Overwriting a support file is not the same as gaining a shell, but it is a serious integrity problem: it can corrupt device state, poison diagnostics, and potentially influence configuration if an attacker can abuse how those files are later consumed.

Severity is rated MEDIUM with a CVSS score of 6.9. The vector is network-reachable with low complexity and no privileges or user interaction required, which is a bad combination for any device that is exposed to the internet. EPSS sits at 0.7 percent, a low probability estimate for the next 30 days, but that number should not be treated as reassurance given CISA has confirmed exploitation in the wild. RouterOS is a popular target for botnets and edge-device operators, and authentication bypasses on SSH are exactly the kind of primitive that gets folded into larger campaigns.

Affected versions are everything before 6.49.21 on the Long-term 6.x line, before 7.23.4 on the Long-term 7.x line, and before 7.24.2 on the Stable channel. If you cannot identify your exact build, check the version string reported by your management interface before assuming you are safe.

Remediation and Mitigation

The primary fix is to update RouterOS. Upgrade to 6.49.21, 7.23.4, or 7.24.2 depending on which release channel you run, and reboot or complete the upgrade procedure so the new binaries take effect. MikroTik advisories are the authoritative source for the exact build matrix.

If you cannot patch immediately, reduce exposure as much as possible. Restrict SSH access to trusted management networks with firewall rules rather than leaving it open to the internet, disable SSH entirely where it is not operationally required, and audit the managed file namespace on affected devices for unexpected changes to support and diagnostic files. Log review should focus on SSH connections that requested rekey before authentication completed, since those sequences are the signature of this bug.

Rotate any credentials or secrets that may have been stored in files an attacker could have read or replaced, and treat suspicious configuration drift as a potential indicator of compromise rather than a mistake. Data breach reports are available at breach reports and ongoing coverage at security news if you need to confirm whether your environment appears in related incident reporting.

Security Insight

This case is a reminder that the SSH handshake is security-critical state machine code, not plumbing to be trusted implicitly. A rekey transition that skips the authentication gate is the kind of ordering bug that no amount of downstream command filtering fully contains. MikroTik’s device base is enormous and heavily targeted by IoT botnets, so a bypass reachable with a crafted handshake and a single exec request is a high-leverage primitive. The gap between a 0.7 percent EPSS score and confirmed exploitation says more about how quickly edge-device bugs get operationalized than about the actual risk to any individual device.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs