CVE-2026-67279

An unauthenticated client can exploit a behavioral workflow flaw in MikroTik RouterOS to execute arbitrary commands, which can be chained with CVE-2026-86060 for full remote code execution.

MikroTik RouterOS allows unauthenticated attackers to open a session channel and send exec requests via an improper behavioral workflow enforcement. This flaw can be chained with CVE-2026-86060 to achieve full remote code execution, enabling attackers to compromise network infrastructure. DIB organizations must urgently patch RouterOS and monitor for exploitation, as this represents a critical gap in secure development and patching cycles that directly impacts compliance with NIST 800-171 requirements for protecting unclassified information.

Shame score — A vendor with a history of high-severity vulnerabilities shipped an unpatched flaw allowing unauthenticated remote code execution that is actively exploited in the wild, demonstrating severe negligence in secure development and patching cycles.