Known Exploited Vulnerabilities September 25, 2026 · CISA KEV Catalog

CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

Summary: CVE-2026-67279 is an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS that could let an unauthenticated client open a session channel and send an exec request. CISA lists it in the KEV catalog with a remediation due date of 2026-09-28, and notes it can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
What's compelling: An unauthenticated client can open a session and send an exec request on RouterOS, and CISA states this flaw chains into unauthenticated exploitation of a second CVE - so the exposure is not a single bug but a path. Known ransomware campaign use is listed as unknown, and the remediation deadline is 2026-09-28.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-67279 MikroTik
Related: CVE-2026-67277: Mikro Tik RouterOS Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Sep 10, 2026
CVE-2026-86060: Mikro Tik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability Known Exploited Vulnerabilities · Sep 10, 2026
CVE-2018-7445: Mikro Tik RouterOS Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 08, 2022