CISA says attackers are actively exploiting a MikroTik RouterOS flaw that can be abused before login on exposed devices. The bug, CVE-2026-67279, is described as a medium-severity pre-authentication SSH state-machine or workflow bypass in MikroTik RouterOS, and federal agencies have until September 28, 2026 to remediate. The article gives no further version list or exploitation specifics.
Why it matters: Internet-facing routers are security gateways, so even a medium-severity pre-authentication flaw deserves fast attention when exploitation is active. Organizations using MikroTik devices should patch or mitigate immediately and review access logs for suspicious SSH activity.
info@thehackernews.com (The Hacker News)
2026.09.26
90% relevant
This article also covers the same MikroTik RouterOS exploitation event, adding another source confirming active attacks against the pre-authentication flaw.
Bill Toulas
2026.09.25
100% relevant
This article is the first tracked indication here that CISA says CVE-2026-67279 is being exploited in the wild, making it a distinct new vulnerability-tracking story.
← Back to all stories