Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279)

4 karet z 4 položek · v celém archivu · celý přehled CZ · EN/orig

CVE-2026-67279

KEV ✓ EPSS 0.01 EPSS k 21. 10. 2026 náprava do 28. 9. 2026

Hodnocení závažnosti

6.9 CVSS 4.0 CERT-PL

útok odkudkoli z internetu žádné ochrany se neobcházejí funguje v běžném nastavení bez přihlášení bez zásahu uživatele

dopad únik části dat dílčí změna dat bez výpadku

přesah bez úniku v okolních systémech beze změny v okolních systémech bez výpadku v okolních systémech

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

zvyšuje závažnost mírně zvyšuje závažnost snižuje závažnost

cve.org · NVD

25. 9. 2026 · zachyceno 17:00

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279)

CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities catalog. Affected product: MikroTik RouterOS. Remediation due date: 2026-09-28.

KEV ✓ EPSS 0.01 CVE-2026-67279 MikroTik US

tg: zneužíváno tg: zranitelnost

25. 9. 2026 · zachyceno 17:00 · CISA KEV · Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279)

22. 9. 2026 16:00

MikroTrick: technical analysis, disclosure process, and the use of LLM agents

We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.

KEV ✓ EPSS 0.06 CVE-2026-67279 CVE-2026-86060 MikroTik PL

tg: zneužíváno tg: rozbor tp: AI

22. 9. 2026 16:00 · CERT Polska · MikroTrick: technical analysis, disclosure process, and the use of LLM agents

9. 9. 2026 · zachyceno 03:30

Actively exploited MikroTik RouterOS zero-day vulnerability

Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv4.0: 9.2, CVEs: CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060, CVE-2026-67277, CVE-2026-67276, Summary: MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. There is evidence that these vulnerabilities are under active exploitation. This is an important security update. Most configurations are not at risk, but upgrading is highly…

KEV ✓ EPSS 0.06 CVSS 9.2 CVE-2026-67276 CVE-2026-67277 CVE-2026-67278 CVE-2026-67279 CVE-2026-67281 CVE-2026-86060 MikroTik FI

tg: zneužíváno tg: zranitelnost

9. 9. 2026 · zachyceno 03:30 · NCSC-FI · Actively exploited MikroTik RouterOS zero-day vulnerability

5. 9. 2026 15:05

Vulnerabilities in Mikrotik RouterOS software

CERT Polska has found 6 vulnerabilities (from CVE-2026-67276 to CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060) in Mikrotik RouterOS software.

KEV ✓ EPSS 0.06 CVE-2026-67276 CVE-2026-67279 CVE-2026-67281 CVE-2026-86060 MikroTik PL

tg: zranitelnost

5. 9. 2026 15:05 · CERT Polska · Vulnerabilities in Mikrotik RouterOS software