MikroTik RouterOS: 3 Exploited Pre-Auth SSH & btest Bugs (CVE-2026-86060, 67277, 67279)

Published 2026-10-08 · Last updated 2026-10-08

What the bugs are

All three are reachable before login, which is what makes them dangerous on routers with management services open to the internet:

• CVE-2026-86060: RouterOS’s SSH login helper mishandles usernames that start with a prohibited character. A crafted username lets an attacker change the trusted policy mask that decides what a session can do, escalating privileges.
• CVE-2026-67277: the bandwidth-test (btest) server accepts a “related” connection before the primary session has authenticated. An unauthenticated client can then start a UDP test that sends back uninitialised kernel buffer data (a memory leak), and a size-calculation underflow can crash and restart the router.
• CVE-2026-67279: if an SSH client asks for a rekey before authenticating, RouterOS moves on to the session stage anyway. The attacker can open a channel and send commands that create or overwrite files in RouterOS’s file area, including support files that contain configuration data.

MikroTik shipped the fixes quietly at first; researchers reverse-engineered the 7.23.4 patch, and CERT Polska then reported the bugs being exploited in the wild.

Am I affected?

/system resource print          # look at "version"
/ip service print               # is ssh enabled, and on which address/port?
/tool bandwidth-server print    # is the btest server enabled?

Or in Winbox/WebFig: System → Packages, IP → Services, Tools → BTest Server.

Vulnerable if the version is below 6.49.21 (v6), below 7.23.4 (v7 long-term), or 7.24.x below 7.24.2.

How to patch

/system package update check-for-updates
/system package update install
# after it reboots, also update the bootloader:
/system routerboard upgrade
/system reboot

Take a backup first (/system backup save and /export file=pre-upgrade), and download the files off the router.

Lock it down (do this even after patching)

• Turn off the btest server unless you use it: /tool bandwidth-server set enabled=no
• Restrict SSH and Winbox to your LAN or a management subnet: /ip service set ssh address=192.168.88.0/24 (same for winbox, www, api). Disable services you don’t use: /ip service disable telnet,ftp,api,api-ssl,www
• Make sure the default input-chain firewall drops anything not coming from the LAN: the stock rule drop all not coming from LAN on /ip firewall filter should be present and enabled.
• Manage the router remotely over WireGuard (built into RouterOS 7) instead of exposing SSH.

Was my router hit?

• Check /user print for accounts you didn’t create and /system scheduler print / /system script print for unknown entries.
• Look at /file print for unexpected files, and /log print where topics~"ssh|account" for logins from unknown IPs.
• Check /ip socks print, /ip proxy print and /ip dns print. Compromised MikroTiks are commonly turned into proxies or have DNS hijacked.
• If anything is off, netinstall a clean RouterOS, restore config by hand (not from a backup that might be tampered with), and change all passwords.

Sources

• MikroTik security advisory (September 2026)
• CERT Polska: vulnerabilities in MikroTik RouterOS actively exploited
• CVE-2026-86060 · CVE-2026-67277 · CVE-2026-67279
• CISA Known Exploited Vulnerabilities catalog

← Back to Knowledge Base