{"vulnerability": "CVE-2026-67276", "sightings": [{"uuid": "a60eb0c8-e91f-4f83-bb5e-f4bdbe8889fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muse5sihmx2j", "content": "CVE-2026-67276 - routeros\nMikrotik RouterOS does not fully verify SSH keys, so someone who knows part of a legitimate key can craft a fake key and gain access as that user. This could let an attacker run\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#routeros #mikrotik #CVE #infosec", "creation_timestamp": "2026-09-05T20:50:05.127204Z"}, {"uuid": "051e6e71-ab68-458b-bb52-ded6ba62289d", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4974c0db-04af-472f-a69e-78bc275e7d1b", "content": "", "creation_timestamp": "2026-09-05T22:00:02.243210Z"}, {"uuid": "e1338c4c-9284-4790-9fc8-daba7650bacf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3musihjvedt2f", "content": "\ud83d\udea8 CVE-2026-67276 \u2014 CVSS 9.2 CRITICAL\n\nRouterOS does not compare the complete RSA public key when matching an SSH authentication request to an aut...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-67276\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-05T22:07:07.053727Z"}, {"uuid": "15ef6991-d0ee-41f0-a949-3a27a35b289e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "Telegram/iJR95E8kv61jfY2vytdD0YiVw2BBATVelGZktxN4BZZcfkCA", "content": "", "creation_timestamp": "2026-09-06T08:00:07.615814Z"}, {"uuid": "968b4bf5-7e2d-479e-a435-e7855202bf60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "Telegram/Vc2SdgBOuxOFw-ldqM8D03_f1b-HBh3AsCRLq5dgxJuo37SM", "content": "", "creation_timestamp": "2026-09-06T11:00:06.316194Z"}, {"uuid": "205374fd-5957-4b67-acc1-3b4f370dc94d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-06T11:00:06.548809Z"}, {"uuid": "d4630bb5-b046-419c-aef8-38cc1f367006", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://t.me/GithubRedTeam/101380", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a mikrotrick-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-06 12:19:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-06T14:00:04.749241Z"}, {"uuid": "208a0bb6-3c45-4aa2-82ac-3869f7998360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3muuhza6e3g25", "content": "Just another Tuesday in IT, where exposed MikroTik RouterOS boxes with SSH enabled are currently handing complete administrative control to anyone who asks nicely via CVE-2026-67276 and CVE-2026-86060. We are expected to frantically scramble and patch to RouterOS 7.24.2, 7.23.4, ...\n\nRead full story", "creation_timestamp": "2026-09-06T17:04:26.177599Z"}, {"uuid": "5684916a-c238-493c-a476-5709867f0b3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3muuis6udoc2w", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nMikroTrick: vulnerabilidad cr\u00edtica de omisi\u00f3n de autenticaci\u00f3n SSH en MikroTik RouterOS (CVE-2026-67276)\n\nLeer M\u00e1s / Read More...", "creation_timestamp": "2026-09-06T17:18:23.571268Z"}, {"uuid": "ef111d41-c0eb-4d33-9750-9307dafe2704", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://www.acn.gov.it/portale/w/mikrotik-rilevato-sfruttamento-in-rete-di-nuove-vulnerabilita", "content": "MikroTik ha rilasciato aggiornamenti di sicurezza al fine di correggere 6 nuove vulnerabilit\u00e0, di cui 2 con gravit\u00e0 \u201ccritica\u201d e 2 con gravit\u00e0 \u201calta\u201d. Tra queste, si evidenzia lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-67276 e CVE-2026-86060, che potrebbero consentire ad un utente malintenzionato di eludere i meccanismi di autenticazione e di elevare i propri privilegi sui sistemi interessati.", "creation_timestamp": "2026-09-06T19:00:45.637213Z"}, {"uuid": "a16f97e1-7b9f-4b0a-88e6-3b7085cf8b5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117225668644775403", "content": "RouterOS SSH public-key authentication bypass (CVE-2026-67276) https://github.com/dinosn/mikrotrick-poc", "creation_timestamp": "2026-09-06T19:09:11.075940Z"}, {"uuid": "d10f62a0-b061-45b9-81a7-e004857f9103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3muuozchdtii2", "content": "RouterOS SSH public-key authentication bypass (CVE-2026-67276) https://github.com/dinosn/mikrotrick-poc", "creation_timestamp": "2026-09-06T19:10:33.425685Z"}, {"uuid": "d29c4e05-3d60-435d-9cf1-b331c9c9b267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://www.cert.si/si-cert-2026-05", "content": "", "creation_timestamp": "2026-09-06T20:45:11.593840Z"}, {"uuid": "9b94dc9f-33b9-4788-8707-08d863181d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muv6xcpdk226", "content": "\ud83d\udd34 MikroTrick \u2014 MikroTik routers under active attack\n\nAttackers are exploiting CVE-2026-67276 + CVE-2026-86060 against Internet-exposed RouterOS devices. The chain can bypass normal\n\nstemshop.top/blog/mikroti...\n\n#CVE #CVE202667276 #CVE202686060 #MikroTik #RouterOS #MikroTrick #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-06T23:55:01.562239Z"}, {"uuid": "f5808a08-2caa-4e5c-9bee-35ee32b4ecd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muv7avpi7a2s", "content": "CVE-2026-67276 is trending. Hype score 5, currently #7 on cvemon.\n\nRouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-67276", "creation_timestamp": "2026-09-07T00:00:19.704314Z"}, {"uuid": "fb0bb3c6-d6c3-43e6-b6e2-f8f2c78b7672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3muvbioj4q62r", "content": "MikroTik Routers Bleed Out While Bureaucrats File the Paperwork\nPANIC 84% | Lag 0.0h | GrayZone says attackers are exploiting CVE-2026-67276 and CVE-2026-86060 against Internet-exposed Ro\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-09-07T00:40:28.136538Z"}, {"uuid": "f696d9f7-49eb-4841-928c-f2ab2f299869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101380", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a mikrotrick-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-06 12:19:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-07T01:00:11.452767Z"}, {"uuid": "e6fc63f1-de97-4df2-a63b-03acb7dd5cef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "Telegram/iJR95E8kv61jfY2vytdD0YiVw2BBATVelGZktxN4BZZcfkCA", "content": "", "creation_timestamp": "2026-09-07T01:00:30.399532Z"}, {"uuid": "d85090a2-7730-4151-b1fe-e1a4d981eeea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "Telegram/Vc2SdgBOuxOFw-ldqM8D03_f1b-HBh3AsCRLq5dgxJuo37SM", "content": "", "creation_timestamp": "2026-09-07T01:00:17.852426Z"}, {"uuid": "ddd4734d-515d-4073-b052-32c12d5e3a2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-07T01:00:18.180467Z"}, {"uuid": "2aa08544-d5e1-4047-80d5-e5df41d85efa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://www.acn.gov.it/portale/w/mikrotik-rilevato-sfruttamento-in-rete-di-nuove-vulnerabilita", "content": "MikroTik ha rilasciato aggiornamenti di sicurezza al fine di correggere 6 nuove vulnerabilit\u00e0, di cui 2 con gravit\u00e0 \u201ccritica\u201d e 2 con gravit\u00e0 \u201calta\u201d. Tra queste, si evidenzia lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-67276 e CVE-2026-86060, che potrebbero consentire ad un utente malintenzionato di eludere i meccanismi di autenticazione e di elevare i propri privilegi sui sistemi interessati.", "creation_timestamp": "2026-09-07T01:00:32.989230Z"}, {"uuid": "81361d58-45cf-4c2a-9446-5f0dc6daab8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "published-proof-of-concept", "source": "Telegram/lgDWJ2Z8x0hQFJvErJIEkWoLydLh7Vg_T4dFMiT-ue-b2Vs", "content": "", "creation_timestamp": "2026-09-07T04:00:04.335409Z"}, {"uuid": "b9fc95c4-0145-4026-9790-06c896da0203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3muvq3vq6ug2d", "content": "Daily IT Security Digest \u2014 2026-09-07\nadministrative control over RouterOS devices. The PoC (Proof of Concept) is publicly disclosed and the chain exploits CVE-2026-67276 (CVSS 10). Thousands of MikroTik routers are estimated to be running vulnerable versions. Organizations should immediately apply", "creation_timestamp": "2026-09-07T05:01:45.711595Z"}, {"uuid": "ab852345-1e9c-4b8a-96f1-b0be558f1a72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67276", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/431", "content": "CVE-2026-67276\n\nMikroTik lab PoC \u2014 RouterOS SSH public-key auth bypass", "creation_timestamp": "2026-09-07T07:00:05.117293Z"}, {"uuid": "9b21aecc-2db0-4737-be2e-0ababa036d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67276", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3muxa6c2ylc2n", "content": "Monday's fuck-up - this time it's the invincible Mikrotik - github.com/dinosn/mikro... research - cert.pl/en/posts/202... #redteam #mikrotik #cve-2026-67276 #critical #routeros #bypass #ssh #router", "creation_timestamp": "2026-09-07T09:22:24.221904Z"}]}