CVE record · 6 sources
CVE-2026-67279
KEV · due 28 Sep 2026 (overdue)Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- Vendor
- MikroTik
- Product
- RouterOS
- EPSS
- 1.00 (p100)
- CISA KEV
- added 25 Sep 2026, due 28 Sep 2026 (34d overdue)
- Weakness
- CWE-841
- Exposure class
- Edge / VPN / firewall, Collaboration
Coverage
5Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve…
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability CVE-2026-67279 Mikrotik…
-
MikroTrick: technical analysis, disclosure process, and the use of LLM agents
We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics…
-
Vulnerabilities in Mikrotik RouterOS software
CERT Polska has found 6 vulnerabilities (from CVE-2026-67276 to CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060) in Mikrotik RouterOS software.
-
September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.