Question 1

What is CVE-2026-67279 — Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability?

Accepted Answer

Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

Question 2

What is the authoritative source for CVE-2026-67279?

Accepted Answer

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVSS	6.5 ()
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS	1.03% probability of exploitation · percentile 62.4% · 2026-10-05T12:00:23Z
Last modified	2026-09-26

CVE-2026-67279Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

Description

Scoring

CISA KEV entry