CVE-2026-67278

CVE Enrichment

CVSS: 6.3 MEDIUM
EPSS: 0.25%
EPSS Percentile: 15.74%
CISA KEV: Not listed

Description

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 06-Sep-2026 03:17
Last Modified: 25-Sep-2026 21:56
EPSS Date: 2026-10-21
CWE: CWE-347

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:L /
                            VI:L /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

mikrotik / routeros Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.0 · before (exclusive) 7.23.6
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
mikrotik / routeros Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.24 · before (exclusive) 7.24.3
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 02:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The updates also resolve CVE-2026-67278 (enables TLS server impersonation), CVE-2026-67279 (allows unauthenticated attackers to tamper with files, including configuration files), and CVE-2026-67281 (allows attackers to MikroTik Patches RouterOS Flaws Reportedly Chained to Take Over Routers

CVE (5)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.