MikroTik RouterOS Unauthenticated Session Channel Vulnerability (CVE-2026-67279)

Catalog analysis: CISA added this entry on September 25, 2026. The entry reflects catalog information retrieved on September 25, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-67279 is an improper enforcement of behavioral workflow vulnerability (CWE-841) affecting MikroTik RouterOS. The flaw allows an unauthenticated client to open a session channel and send an exec request. While this vulnerability represents a specific failure in workflow enforcement, its risk is compounded by the fact that it can be chained with CVE-2026-86060 to achieve full unauthenticated exploitation.

Exposure and applicability

This vulnerability applies to infrastructure utilizing MikroTik RouterOS. The primary exposure path involves any interface where an unauthenticated attacker can reach the affected services. Vulnerability management teams should prioritize assets with direct internet exposure, as these are most susceptible to the initial session channel opening required for this exploit chain.

Remediation priorities

Based on our analysis, remediation should be prioritized according to the following hierarchy:

1. Immediate Patching/Mitigation: Apply vendor-supplied mitigations and updates immediately. Because CVE-2026-67279 serves as a prerequisite for exploiting CVE-2026-86060, addressing this flaw disrupts the exploit chain.
2. Exposure Reduction: For assets where immediate patching is not feasible, restrict access to management interfaces via firewall rules or ACLs to ensure only trusted internal IPs can initiate sessions.
3. Chain Analysis: Identify all RouterOS assets and verify if they are also susceptible to CVE-2026-86060, as the combined presence of both vulnerabilities significantly increases the risk profile.

How to validate remediation

Verification must move beyond simple version checks. To ensure exposure is actually reduced, defenders should:

• Verify Mitigation Application: Confirm that vendor-specific mitigations have been applied and are active according to the official MikroTik security guidance.
• Network Validation: Use authorized network scanning or configuration audits to verify that management interfaces are no longer reachable from untrusted zones.
• Configuration Audit: Review session handling logs for unauthorized ‘exec’ requests or anomalous session channel openings that may indicate attempted exploitation prior to or during the remediation window.

Limits and open questions

A deployed update does not guarantee total immunity if other configuration weaknesses exist. Residual risk remains if management interfaces remain exposed to wide networks despite patching. It is currently unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, while CISA has provided a due date for federal agencies, non-federal organizations must determine their own urgency based on their specific threat model and asset exposure.

Source and editorial note

CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability · Source date: September 25, 2026 · Retrieved September 25, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment