Active Exploits Target MikroTik RouterOS Workflow Flaw

TL;DR

• MikroTik RouterOS contains a workflow bypass vulnerability that lets unauthenticated users open session channels and execute commands [^1].
• CISA added the flaw to its active exploit catalog, warning that attackers are chaining it to compromise network infrastructure [^2].

Background

MikroTik RouterOS is the operating system powering millions of routers, switches, and wireless access points worldwide, from home offices to enterprise networks. Because these devices route sensitive data and police network boundaries, they are primary targets for threat actors. Security on these devices relies on strict access control workflows. When a device fails to enforce the correct order of operations during user authentication, the entire perimeter of the network is exposed to unauthorized command execution.

What happened

On September 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to include CVE-2026-67279 [^2]. This vulnerability is classified as an improper enforcement of behavioral workflow within MikroTik RouterOS [^1]. In simpler terms, the software fails to verify that a client has completed the necessary authentication steps before granting access to critical administrative functions.

In standard network protocols, a state machine governs the transition from an unauthenticated connection to an authorized session. This state machine requires a strict sequence: connection establishment, identity presentation, cryptographic challenge, and finally, session authorization. Under CVE-2026-67279, this sequence is broken. The router's software permits an external client to skip the intermediate authentication phases entirely. By sending a specific sequence of commands out of order, the client forces the server's state machine to transition directly to an authorized state, granting execution privileges without validating credentials [^1].

Crucially, security researchers have observed threat actors chaining this vulnerability with another flaw, CVE-2026-86060, to achieve complete system compromise [^1]. By combining the workflow bypass of CVE-2026-67279 with a secondary privilege escalation or remote code execution exploit, attackers can install persistent backdoors, modify routing tables, or intercept local network traffic. The active exploitation in the wild prompted CISA to mandate federal agencies to patch or disable the affected services immediately to mitigate systemic risk [^2].

Why it matters

The active exploitation of MikroTik devices represents a significant threat to network integrity across multiple sectors. Routers are the gatekeepers of the network. When a router is compromised, the security of every device behind it is called into question. Unlike a compromised workstation, which can be isolated relatively easily, a compromised router allows an attacker to perform silent man-in-the-middle attacks, capture unencrypted credentials, and pivot to internal servers without triggering standard endpoint detection systems.

Many small-to-medium businesses and remote offices deploy MikroTik devices because they offer enterprise-grade routing features at a highly accessible price point. However, these environments rarely have dedicated security operations centers to monitor router logs for anomalous behavior. A compromised edge router can remain undetected for months, serving as a persistent launchpad for internal network reconnaissance. The fact that threat actors are actively chaining this workflow vulnerability with CVE-2026-86060 indicates a highly coordinated campaign designed to systematically compromise these unmonitored endpoints [^1][^2].

Furthermore, this vulnerability highlights the danger of architectural flaws in device state machines. Many security audits focus on finding memory corruption bugs like buffer overflows, but logical workflow vulnerabilities are often harder to detect through automated scanning. These flaws exist in the design logic itself—allowing a step in a protocol to be skipped or executed out of order. As network infrastructure becomes more complex, ensuring that authentication states are rigidly enforced at every layer of the operating system is paramount to preventing unauthorized access.

Practical example

Imagine you run a small design studio with a MikroTik router managing your office network. The router's management port is exposed to the internet so your external IT consultant can perform remote maintenance.

An attacker scans your public IP address and identifies the active MikroTik management interface. Instead of attempting to brute-force your admin password, the attacker uses an automated tool to exploit CVE-2026-67279. The tool sends a sequence of network packets that tricks the router's state machine into opening an administrative session channel without asking for a password.

Within seconds, the attacker sends an execution command to configure a new, hidden administrator account. They now have permanent, silent access to your router, allowing them to monitor your office's internet traffic and search for connected file servers to target with ransomware.

Related gear

We recommend this book because it offers practical methodologies for auditing network perimeters and identifying the exact logical flaws that attackers exploit in modern routers.