---
id: CVE-2026-67276
title: >-
  RouterOS does not compare the complete RSA public key when matching an SSH
  authentication request to an authorized user key, checking the key type and
  modulus but omitting the exponent
summary: >-
  RouterOS does not compare the complete RSA public key when matching an SSH
  authentication request to an authorized user key, checking the key type and
  modulus but omitting the exponent. Because signature verification uses the
  client-supp…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-347
vendor: Mikrotik
product: RouterOS
affected:
  - RouterOS >= 7.24 < 7.24.2
  - RouterOS >= 7.9 < 7.23.4
published: '2026-09-05'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T05:17:28.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67276'
references:
  - url: 'https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve'
    label: cvd@cert.pl
  - url: >-
      https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
    label: cvd@cert.pl
  - url: 'https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801'
    label: cvd@cert.pl
  - url: 'https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800'
    label: cvd@cert.pl
  - url: 'https://mikrotik.com/supportsec/september-2026-vulnerability/'
    label: cvd@cert.pl
  - url: >-
      https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
    label: cvd@cert.pl
  - url: 'https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802'
    label: cvd@cert.pl
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T14:48:45.722509Z'
cvssSource: cna
epss: 0.00367
epssPercentile: 0.27793
exploits:
  github: 4
  githubRepos:
    - 'https://github.com/dinosn/mikrotrick-poc'
    - 'https://github.com/BlackHatExploitation/exploit-mikrotik-2026'
    - 'https://github.com/HORKimhab/CVE-2026-67276'
  checkedAt: '2026-09-25T08:21:08.289Z'
exploitAvailable: true
ingestedAt: '2026-09-06T10:53:52.337Z'
---

## Overview

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.