CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities catalog. Affected product: MikroTik RouterOS. Remediation due date: 2026-09-28.
KEV ✓ EPSS 0.01 CVE-2026-67279 MikroTik US
We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.
KEV ✓ EPSS 0.06 CVE-2026-67279 CVE-2026-86060 MikroTik PL
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv4.0: 9.2, CVEs: CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060, CVE-2026-67277, CVE-2026-67276, Summary: MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. There is evidence that these vulnerabilities are under active exploitation. This is an important security update. Most configurations are not at risk, but upgrading is highly…
KEV ✓ EPSS 0.06 CVSS 9.2 CVE-2026-67276 CVE-2026-67277 CVE-2026-67278 CVE-2026-67279 CVE-2026-67281 CVE-2026-86060 MikroTik FI
CERT Polska has found 6 vulnerabilities (from CVE-2026-67276 to CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060) in Mikrotik RouterOS software.
KEV ✓ EPSS 0.06 CVE-2026-67276 CVE-2026-67279 CVE-2026-67281 CVE-2026-86060 MikroTik PL