GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
KEV Entry

CVE-2026-67276

Known Exploited Vulnerability Entry ENISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-67276

2026-09-05 00:00 UTC

Timestamps

2026-09-05

2026-09-05

Scope

MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-347 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

References
  • {'id': 'CVE-2026-67276', 'url': 'https://www.cve.org/CVERecord?id=CVE-2026-67276'}
  • {'id': 'EUVD-2026-72024', 'url': 'https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72024'}
  • {'id': 'source', 'url': 'https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/'}

4974c0db-04af-472f-a69e-78bc275e7d1b

ENISA
cce329bf-df49-4c6e-a027-80be2e6483bd

2026-09-05 22:00 UTC

2026-09-05 22:00 UTC

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
csirt_report enisa-cnw-kev successful_exploitation 0.75
View details 
{
  "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON",
  "cwes": [
    "CWE-347"
  ],
  "dateReported": "2026/09/05",
  "euvd": "EUVD-2026-72024",
  "exploitationType": [
    "unknown"
  ],
  "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/",
  "originSource": "CERT.PL",
  "patchedSince": "2026/09/03",
  "product": "RouterOS",
  "threatActorsExploiting": [],
  "vendorProject": "MikroTik",
  "vulnerabilityName": "MikroTrick"
}
 -
Export Options
JSON Object JSON API View Full Catalog