Why are MikroTik routers back on CISA's exploited list?
Timeline for RouterOS
Mentioned in: CISA set three-day deadlines on 34 flaws
Cybersecurity: Threats and DefencesBackground
RouterOS is the operating system that runs MikroTik routers and other MikroTik devices, found in large numbers at the EDGE of small-business and internet-provider networks. Many are never updated after installation, so each new RouterOS flaw is useful to botnet builders.
In September 2026 MikroTik shipped fixes for six flaws reported by CERT.pl. The one seen exploited, CVE-2026-67279, let anyone WHO could reach the SSH port run commands without logging in. Fixes arrived in 7.24.2, 7.23.4 and 6.49.21, but one certificate fix was incomplete; MikroTik says 7.24.3, 7.23.6 or 6.49.21 covers all six.
RouterOS has been abused at scale before. The 2021 Mēris botnet was built from MikroTik routers compromised through a Winbox flaw dating from 2018.
RouterOS returns to the exploited list
CISA added CVE-2026-67277, CVE-2026-86060 and CVE-2026-67279 to its exploited list between 10 and 25 September 2026, the first RouterOS entries since 2022. CERT.pl had reported six flaws to MikroTik under the name "MikroTrick".
Two of the three are dangerous as a pair. CVE-2026-67279 lets a client open a session without logging in, and CVE-2026-86060 lets a user change the policy mask that decides what they may do. Chained, the two flaws give an outsider control of a MikroTik router. CISA's entries name no actor or campaign. RouterOS updates cost nothing, but many MikroTik routers sit in branch offices or customer premises with no local IT staff to install them.