On September 25, 2026, CISA added CVE-2026-67279 to its KEV catalog, with a deadline of September 28. On its own, it's described in one dry sentence. In context, it changes how you should read a flaw you already know: CVE-2026-86060, the RouterOS privilege escalation that entered KEV on September 10.
| Field | Value |
|---|---|
| Product | MikroTik RouterOS |
| Type (CISA) | Improper enforcement of behavioral workflow |
| KEV added | 2026-09-25 |
| CISA deadline | 2026-09-28 |
| NVD CVSS / vector | not published |
| NVD versions | not published |
NVD hasn't published a score, vector or version list at the time of writing. Everything below rests on the CISA entry; for the version to install, MikroTik's release notes and advisories are authoritative.
What CISA Says
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
"Improper enforcement of behavioral workflow" (CWE-841) means a protocol whose steps aren't enforced in order. Normally a client authenticates, and only then opens a session and asks to run something. Here, RouterOS accepts steps it should have refused until authentication was complete.
It's the same family of defect as the one described for CVE-2026-67277 in our September 10 article: a service that accepts an action before the matching session has been authenticated.
Why the Chain Changes Everything
In September, CVE-2026-86060 was a privilege escalation: you already needed access to the router to exploit it. That's what let people, rightly or wrongly, rank it behind flaws exposed without an account.
CISA now states that CVE-2026-67279 provides that access without authentication. Combined, the two become a compromise of the router from the network, with no credentials.
If you'd postponed the 86060 fix because "you needed an account", that assumption no longer holds.
With MikroTik, the stakes go beyond the device itself: these routers have historically been among the most enlisted in botnets, and a compromised router sees all the traffic of the site it serves.
Versions
NVD publishes no affected or fixed version for CVE-2026-67279. I won't invent one.
For CVE-2026-86060, the fixed versions are 6.49.21, 7.23.4 and 7.24.2 (see our September article). Nothing says they also fix 67279: check the MikroTik release notes published since, and install the latest release of your channel (Long-term or Stable).
Detection
- Admin sessions in RouterOS logs with no matching successful login, or from unknown addresses
- User accounts added or groups changed (
/user) that nobody created - Unexpected scripts and schedulers (
/system script,/system scheduler): the most common persistence on RouterOS - Proxies, tunnels or NAT rules added, and unusual outbound traffic from the router itself
- Unknown files in the
/filelist
Mitigation
- Update RouterOS to the latest release of your channel published by MikroTik, checking the release notes for a mention of CVE-2026-67279. The CISA deadline has passed.
- Shut off management from outside: restrict each management service (SSH, Winbox, API, WebFig, Telnet) to admin networks using the services' allowed addresses and the firewall, and disable the ones you don't use.
- Never expose router management on the WAN interface. If remote access is needed, go through a VPN.
- If you suspect compromise: an update removes neither added accounts nor scripts. Export the configuration, compare it with a known-good baseline, and without a reliable baseline, reset and reconfigure, then change every password.
Why Continuous Monitoring of Your Routers Matters
Two CVEs entering KEV two weeks apart, with the second changing the severity of the first: that's the kind of shift you miss when you handle each advisory in isolation.
With cveo.tech, inventory your routers with their RouterOS version, and get alerted as soon as a CISA KEV CVE affects them.