26 September 2026
Reference: CVE-2026-67279
1. What is being reported?
The vulnerability means that MikroTik routers running certain versions of RouterOS can be accessed remotely via SSH without any user authentication. Attackers can open a session and run commands that create or change files on the router, including configuration and diagnostic files.
2. What this means in plain English
If your business uses a MikroTik router with the affected software, attackers could take control of it remotely. This could disrupt your internet connection, expose your network to further attacks, or allow changes that compromise your security.
3. Could this affect a small business?
Small businesses using MikroTik routers with the affected versions of RouterOS could be at risk, especially if their routers are accessible from the internet. Organisations not using MikroTik routers or those with updated software are less likely to be affected.
4. What to do now
- Check if your MikroTik router is running an affected version of RouterOS.
- If it is, update the router software immediately to the fixed versions provided by MikroTik.
- If you cannot update right away, ask your IT provider about applying any available mitigations to reduce risk.
- Ensure your router is not unnecessarily exposed to the internet by restricting remote access where possible.
5. Ask your IT provider
Can you confirm if our MikroTik router is affected by CVE-2026-67279 and has been updated to a secure RouterOS version?
6. Bottom line
Update your MikroTik router software promptly to prevent attackers from accessing your network without a password.
Information based on CISA KEV, NVD and reputable security reporting.