Is CVE-2026-67278 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67278 being exploited in the wild.

How severe is CVE-2026-67278?

Critical severity, with a CVSS score of 9.1, published 5 September 2026.

Which products and versions are affected?

MikroTik RouterOS 7.x before 7.23.6 and 7.24.x before 7.24.3.

Is there a fix for CVE-2026-67278?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67278 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67278?

Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67278: MikroTik RouterOS malformed RSA/PKCS#1 v1.5 signature acceptance

CVE-2026-67278 · Severity: critical · CVSS 9.1 · Published 2026-09-05

MikroTik RouterOS, a networking and routing platform used worldwide, accepts improperly formatted RSA signatures in TLS certificate validation and SSH authentication. Because the device trusts a low-exponent root certificate, an attacker can forge trusted certificates for any server without the private key, enabling network traffic interception and credential theft. Additionally, SSH connections can be spoofed to gain unauthorized access to the device.

Technologies: MikroTik RouterOS. Vendors: MikroTik.

Quick answers

Is CVE-2026-67278 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67278 being exploited in the wild.
How severe is CVE-2026-67278?: Critical severity, with a CVSS score of 9.1, published 5 September 2026.
Which products and versions are affected?: MikroTik RouterOS 7.x before 7.23.6 and 7.24.x before 7.24.3.
Is there a fix for CVE-2026-67278?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67278 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67278?: Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper cryptographic signature verification (CWE-347) affecting RSA/PKCS#1 v1.5 signature validation across TLS/X.509 and SSH protocols. An attacker with network access or control of an outbound TLS connection can exploit the acceptance of malformed signatures combined with a low-exponent (e=3) root CA in the trust store to forge intermediate certificates and issue certificates for arbitrary domains. The same flaw undermines SSH host-key authentication. Fixed in RouterOS 7.23.6 and 7.24.3; versions 7.23.4 and 7.24.2 contained incomplete fixes.

Affected products

MikroTik RouterOS 7.x before 7.23.6 and 7.24.x before 7.24.3

Timeline

2026-09-05: disclosed: Vulnerability disclosed by CERT Polska
2026-09-05: exploited: Actively exploited in the wild against RouterOS devices with SSH accessible from the internet

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.