CVE-2026-67276Vulnerability
Reported by 5 independent sources · first reported by CERT Polska · last reported
Last reported 12 days ago
What the reports say
7 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“CVE-2026-67276”
-
Mikrotik security advisory (AV26-887) – Update 2“Open-source reporting indicates that CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 related to MikroTik are being exploited in the wild.”
-
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key“Some publications have incorrectly included a third flaw, CVE-2026-67276, which CERT Polska says is a separate SSH vulnerability that lets an attacker forge an RSA key to log in as an existing user.”
-
MikroTrick: technical analysis, disclosure process, and the use of LLM agents“Some publications incorrectly associated CVE-2026-67276 with the MikroTrick chain.”
-
14th September – Threat Intelligence Report“MikroTik has fixed CVE-2026-67276 and CVE-2026-86060, RouterOS vulnerabilities that can be chained to obtain passwordless SSH access and elevate privileges to full administrator.”
-
Vulnerabilities in Mikrotik RouterOS software“CVE-2026-67276”
-
Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended“CVE-2026-67276 - SSH authentication bypass (CVSS: 9.2)”
Indicators reported together
named in the same reports- 82.192.72[.]4in 3 reports
- 103.102.31[.]18in 2 reports
- idscan[.]netin 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2026-86060, CVE-2026-67279, CVE-2026-67277, CVE-2026-85046, CVE-2026-85880, CVE-2026-81963, CVE-2026-85706, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-87491, CVE-2026-48710, CVE-2025-39964, CVE-2026-20316, CVE-2026-39987, CVE-2026-60137, CVE-2026-63030
Thanks — we review every report.