RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 6.x prior to 6.49.21, or 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by multiple vulnerabilities :

  - RouterOS accepts a 'related' btest connection before the corresponding primary session has     completed authentication. An unauthenticated client can use this state to start an IPv4 UDP     test. With 'random-data=false', the sender transmits an uninitialized tail from a kernel packet     buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow,     anomalously large fragmented output, and can restart the RouterOS kernel. (CVE-2026-67277)

  - RouterOS contains an argument-handling flaw in the SSH login path involving usernames that     begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed,     leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach     the RouterOS login helper. (CVE-2026-86060)

  - RouterOS SSH enters the connection protocol after a client-requested rekey even though user     authentication was never attempted, allowing an unauthenticated client to open a session     channel and send an exec request. On affected builds the server dispatches the command,     enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS     managed file namespace, including support files containing configuration and diagnostic data.
    (CVE-2026-67279)

Note that Nessus has not tested for this issue but has instead relied only on the router's self-reported version number.

ID	Name	Product	Family	Type	Severity
506132	MikroTik RouterOS Improper Enforcement of Behavioral Workflow (CVE-2026-67279)	Tenable OT Security	Tenable.ot	Remote	medium
344588	MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2026-67279

medium

Tenable Plugins

medium

critical