CVE-2026-67279

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 (Long-term) RouterOS versions prior to 7.23.4 (Long-term) RouterOS versions prior to 7.24.2 (Stable)

Description The SSH server improperly enforces the behavioral workflow during a client-requested rekey. This allows an unauthenticated client to bypass authentication, open a session channel, and send an exec request. The server then dispatches the command, enabling the unauthenticated creation, overwrite, and reconstruction of files within the managed file namespace, including support files that contain configuration and diagnostic data.

Recommendations Update to version 6.49.21 (Long-term). Update to version 7.23.4 (Long-term). Update to version 7.24.2 (Stable).