CVE-2026-67278
Last modified
CVE-2026-67278 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mikrotik | Routeros | >= 7.0, < 7.23.6 |
| Mikrotik | Routeros | >= 7.24, < 7.24.3 |
References
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/Mitigation, Third Party Advisory
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-67278?
How severe is CVE-2026-67278?
How do I fix CVE-2026-67278?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-67270Dell Container Storage Modules (CSM) versions prior to 1.18.…7.4
- CVE-2026-67271Dell PowerStore SDNAS, contains an Out-of-bounds Write vulne…9.8
- CVE-2026-67273Dell Container Storage Modules, versions prior to 1.18.0, co…9.6
- CVE-2026-67275Dell PowerProtect One, versions 20.1.0.0 and below, contain …6.5
- CVE-2026-67276RouterOS does not compare the complete RSA public key when m…8.1
- CVE-2026-67277RouterOS accepts a "related" btest connection before the cor…8.2
- CVE-2026-67279RouterOS SSH enters the connection protocol after a client-r…6.5
- CVE-2026-6728The Slider Revolution plugin for WordPress is vulnerable to …5.3
- CVE-2026-67281RouterOS WebFig contains an unauthenticated file-read vulner…7.5
- CVE-2026-67282Joomla Extension - fabrikar.com - Unauthenticated remote cod…10
- CVE-2026-67283Joomla Extension - tabaoca.org - Improper ACL implementation…6.9
- CVE-2026-67284Joomla Extension - tabaoca.org - Improper ACL implementation…5.3
Are you affected by CVE-2026-67278?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST