{"vulnerability": "cve-2026-67279", "sightings": [{"uuid": "c645124f-59fa-4121-bf21-775c0ece1503", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bodx4tdpgh2m7", "content": "CVE-2026-67279 - SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS\nCVE ID : CVE-2026-67279\n \n Published : Sept. 5, 2026, 8:17 p.m. | 1\u00a0hour, 10\u00a0minutes ago\n \n Description : RouterOS SSH enters the connection protocol after a client-requested rekey even though user...", "creation_timestamp": "2026-09-05T21:53:13.986643Z"}, {"uuid": "c82d002e-3550-46c4-ae77-c982c8bc920a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-06T11:00:06.364822Z"}, {"uuid": "0f0fb6d2-730a-467d-a45b-a35e086c6765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://www.cert.si/si-cert-2026-05", "content": "", "creation_timestamp": "2026-09-06T20:45:09.306921Z"}, {"uuid": "cbfff9f3-5e60-4c6d-8c0f-f940ec79cd83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muwwncrqzh2t", "content": "CVE-2026-67279 is trending. Hype score 8, currently #8 on cvemon.\n\nRouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-67279", "creation_timestamp": "2026-09-07T16:31:31.849270Z"}, {"uuid": "0d09c1d3-d00c-490b-b9c7-35bd1bb3c180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/ewenmcneill.bsky.social/post/3mvbvf7fcf22z", "content": "In the case of Mikrotik, that's a lot of work compared with just triggering ssh rekey to glitch past the authentication phase of ssh -- CVE-2026-67279.\n\n(The Mikrotik zeroday seemed to be using CVE-2026-67279 and CVE-2026-86060; the later is the \"-2 username as FD flag\".)\n\ngithub.com/advisories/G...", "creation_timestamp": "2026-09-12T01:08:24.968306Z"}, {"uuid": "a7334f89-ddc8-472a-bbbf-b0b54a6d19b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "https://t.me/sopkacentr/742", "content": "\u041f\u043e \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c (\u041d\u041a\u0426\u041a\u0418) \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u0445 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u00a0CVE-2026-67276,\u00a0CVE-2026-86060,\u00a0CVE-2026-67279,\u00a0CVE-2026-67277,\u00a0CVE-2026-67278,\u00a0CVE-2026-67281, \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u0441\u0435\u0442\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442.\n\u00a0\n\u0412 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438\u00a0MikroTik\u00a0RouterOS\u00a0\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043d\u0430\u0440\u0443\u0448\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u043c.", "creation_timestamp": "2026-09-13T01:00:04.309320Z"}, {"uuid": "b5ae4b0c-3558-4cb0-8163-8c960edaa2fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis", "content": "", "creation_timestamp": "2026-09-22T16:15:34.360560Z"}, {"uuid": "13349bdc-98d7-4415-a232-bdc947be4e6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mw755acl6l2a", "content": "Zero-auth MikroTrick chain brews full router takeover via CVE-2026-67279 & CVE-2026-86060\u2014patch now to avoid breach. #RouterOS #MikroTrick #ZeroAuth #RouterSecurity #SSH #Vulnerabilities thedailytechfeed.com/mikrotrick-z...", "creation_timestamp": "2026-09-23T16:14:18.668414Z"}, {"uuid": "dca480b3-c08e-4b2a-8a11-eaf1c370bcba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw7azmovm22s", "content": "\ud83e\udd16 MikroTik RouterOS: CERT Polska \"MikroTrick\" \u2014 CVE-2026-67279 SSH state-machine flaw chained with CVE-2026-86060 argument injection in login gives full admin control of exposed routers with no password or auth.\nhttps://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html", "creation_timestamp": "2026-09-23T17:23:51.627273Z"}, {"uuid": "88c7e519-7f67-4361-9748-fc7ba2a350b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html", "content": "Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication.\n\nThe chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at", "creation_timestamp": "2026-09-23T19:00:41.659335Z"}, {"uuid": "ebc31fde-ae29-4972-af09-68dd5071f2fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mw7i3dr25e2e", "content": "\ud83d\udce2 MikroTrick : analyse technique de la cha\u00eene CVE-2026-67279 + CVE-2026-86060 sur RouterOS\n\nCet article constitue une analyse technique approfondie de la cha\u00eene de vuln\u00e9rabilit\u00e9s MikroTrick, affectant MikroTik RouterOS. Les patches\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#RouterOS #MikroTik #Cyberveille", "creation_timestamp": "2026-09-23T19:30:05.935918Z"}, {"uuid": "82d61cc8-92e2-40e5-a0bc-64df957bbef1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mw7lobevzc2z", "content": "A chain of two SSH vulnerabilities\u2014CVE-2026-67279 and CVE-2026-86060\u2014allows unauthenticated attackers to gain full administrative control over exposed MikroTik RouterOS devices. [\u2026]", "creation_timestamp": "2026-09-23T20:34:21.861763Z"}, {"uuid": "abc77186-54a1-4027-bbc0-6e4d645e10c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwa4bi4mdf2d", "content": "\ud83e\udd16 \"MikroTrick\": two chained MikroTik RouterOS SSH flaws (CVE-2026-67279 + CVE-2026-86060) grant full admin control of exposed routers without credentials, per CERT Polska. Attacks logged since June.\nhttps://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html", "creation_timestamp": "2026-09-24T01:31:26.409594Z"}, {"uuid": "caadb854-d5c1-457c-90b8-5df819880740", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e256776c-0b8f-41d4-9ac6-b67df9058184", "content": "", "creation_timestamp": "2026-09-24T18:00:53.749850Z"}, {"uuid": "dfe40072-d500-41e4-a159-95741fbb10f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://gist.github.com/TheNuggetXYZ/1122c518a90ea7eb73c63e0bea50cd6b", "content": "23. z\u00e1\u0159\u00ed - https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html\n\nZranitelnost s n\u00e1zvem MikroTrick umo\u017e\u0148uje \u00fato\u010dn\u00edk\u016fm p\u0159evz\u00edt plnou administr\u00e1torskou kontrolu nad routery MikroTik. Tento \u00fatok nevy\u017eaduje znalost hesla, SSH kl\u00ed\u010de, a dokonce ani dokon\u010den\u00ed samotn\u00e9ho procesu ov\u011b\u0159en\u00ed u\u017eivatele. Bezpe\u010dnostn\u00ed experti z CERT Polska zjistili, \u017ee \u00fato\u010dn\u00edci zneu\u017e\u00edvali tuto chybu v praxi je\u0161t\u011b p\u0159edt\u00edm, ne\u017e na ni v\u00fdrobce stihl vydat opravu.\n\n\n\n\nJak funguje \u00fatok MikroTrick podrobn\u011b\n\nCel\u00fd trik spo\u010d\u00edv\u00e1 v propojen\u00ed (z\u0159et\u011bzen\u00ed) dvou r\u016fzn\u00fdch bezpe\u010dnostn\u00edch chyb v opera\u010dn\u00edm syst\u00e9mu RouterOS, kter\u00e9 \u00fato\u010dn\u00edkovi umo\u017en\u00ed kompletn\u011b obej\u00edt standardn\u00ed postup SSH.\n\n1. f\u00e1ze \u2013 Obejit\u00ed p\u0159ihl\u00e1\u0161en\u00ed (CVE-2026-67279): Tato chyba naru\u0161uje spr\u00e1vn\u00e9 po\u0159ad\u00ed krok\u016f v SSH protokolu. \u00dato\u010dn\u00edk se pokus\u00ed p\u0159ipojit a b\u011bhem ov\u011b\u0159ov\u00e1n\u00ed toto\u017enosti vynut\u00ed znovunav\u00e1z\u00e1n\u00ed \u0161ifrovan\u00e9ho spojen\u00ed (tzv. key renegotiation). Zraniteln\u00fd RouterOS se kv\u016fli chyb\u011b v logice po dokon\u010den\u00ed tohoto \u0161ifrov\u00e1n\u00ed p\u0159epne rovnou do f\u00e1ze spu\u0161t\u011bn\u00ed relace, ani\u017e by kdykoliv p\u0159edt\u00edm ov\u011b\u0159il heslo nebo kl\u00ed\u010d u\u017eivatele a \u00fato\u010dn\u00edk se dostane k rozhran\u00ed pro zad\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f, i kdy\u017e technicky nen\u00ed p\u0159ihl\u00e1\u0161en\u00fd.\n\n2. f\u00e1ze \u2013 Z\u00edsk\u00e1n\u00ed pln\u00fdch pr\u00e1v (CVE-2026-86060): Jakmile je \u00fato\u010dn\u00edk uvnit\u0159, zneu\u017eije druhou chybu, kter\u00e1 se nach\u00e1z\u00ed v p\u0159ihla\u0161ovac\u00edm programu RouterOS. Jako jm\u00e9no d\u00e1 \"-2\". Syst\u00e9m nezkontroluje jestli jm\u00e9no za\u010d\u00edn\u00e1 poml\u010dkou a spust\u00ed p\u0159\u00edkaz /nova/bin/login -2, kde se -2 vyhodnot\u00ed jako switch. Program p\u0159e\u010dte identitu a \u00farove\u0148 opr\u00e1vn\u011bn\u00ed z file descriptoru \u010d\u00edslo 2 a \u00fato\u010dn\u00edk dostane root opr\u00e1vn\u011bn\u00ed.\n\n\u00dato\u010dn\u00edci takto upraven\u00e9 p\u0159\u00edstupy zneu\u017e\u00edvali k tomu, aby si v routeru vytvo\u0159ili skryt\u00fd administr\u00e1torsk\u00fd \u00fa\u010det s n\u00e1zvem ops, stahovali si diagnostick\u00e9 soubory a kop\u00edrovali konfiguraci router\u016f na sv\u00e9 vlastn\u00ed servery.\n\n\n\n\n\nJak situaci \u0159e\u0161il MikroTik a co d\u011blat\n\nMikroTik na hrozbu reagoval vyd\u00e1n\u00edm bezpe\u010dnostn\u00edch z\u00e1plat. Samotn\u00e1 aktualizace syst\u00e9mu ale nemus\u00ed sta\u010dit, pokud ji\u017e k napaden\u00ed za\u0159\u00edzen\u00ed do\u0161lo p\u0159ed jej\u00edm sta\u017een\u00edm.\n\n    Kontrola napaden\u00ed: Administr\u00e1tor\u016fm se doporu\u010duje zkontrolovat logy routeru. Jasnou stopou po \u00fatoku je ne\u00fasp\u011b\u0161n\u00e9 p\u0159ihl\u00e1\u0161en\u00ed u\u017eivatele -2 nebo p\u0159\u00edtomnost nezn\u00e1m\u00e9ho \u00fa\u010dtu ops s pln\u00fdmi pr\u00e1vy. V syst\u00e9mu lze tak\u00e9 spustit p\u0159\u00edkaz /system/device-mode/print a ov\u011b\u0159it status za\u0159\u00edzen\u00ed, ale ani to stoprocentn\u011b negarantuje, \u017ee je router bezpe\u010dn\u00fd.\n\n    Doporu\u010den\u00fd postup p\u0159i infekci: Pokud router vykazuje zn\u00e1mky napaden\u00ed (nezn\u00e1m\u00e9 skripty, u\u017eivatel\u00e9, p\u0159enosy dat), CERT Polska doporu\u010duje za\u0159\u00edzen\u00ed okam\u017eit\u011b izolovat od s\u00edt\u011b, prov\u00e9st kompletn\u00ed reset do tov\u00e1rn\u00edho nastaven\u00ed a syst\u00e9m postavit znovu z \u010dist\u00e9, d\u016fv\u011bryhodn\u00e9 konfigurace. Rozhodn\u011b by se nem\u011bla obnovovat z\u00e1loha vytvo\u0159en\u00e1 v dob\u011b, kdy byl router kompromitov\u00e1n.\n\n\n\n\n\n\nVysv\u011btlivka: Co je to SSH a jak b\u011b\u017en\u011b funguje\n\nSSH (Secure Shell) je bezpe\u010dn\u00fd s\u00ed\u0165ov\u00fd protokol, kter\u00fd administr\u00e1to\u0159i pou\u017e\u00edvaj\u00ed ke vzd\u00e1len\u00e9 spr\u00e1v\u011b router\u016f, server\u016f a dal\u0161\u00edch za\u0159\u00edzen\u00ed p\u0159es \u0161ifrovan\u00e9 p\u0159ipojen\u00ed. Za norm\u00e1ln\u00edch okolnost\u00ed prob\u00edh\u00e1 komunikace p\u0159es SSH ve t\u0159ech striktn\u011b navazuj\u00edc\u00edch kroc\u00edch:\n\n    Nav\u00e1z\u00e1n\u00ed \u0161ifrovan\u00e9ho spojen\u00ed: Za\u0159\u00edzen\u00ed a u\u017eivatel si vym\u011bn\u00ed \u0161ifrovac\u00ed kl\u00ed\u010de, aby nikdo na s\u00edti nemohl jejich komunikaci odposlouch\u00e1vat.\n\n    Autentizace (Ov\u011b\u0159en\u00ed toto\u017enosti): U\u017eivatel prok\u00e1\u017ee svou toto\u017enost zad\u00e1n\u00edm spr\u00e1vn\u00e9ho hesla nebo pou\u017eit\u00edm priv\u00e1tn\u00edho SSH kl\u00ed\u010de. Pokud je ov\u011b\u0159en\u00ed \u00fasp\u011b\u0161n\u00e9, server po\u0161le potvrzuj\u00edc\u00ed zpr\u00e1vu.\n\n    Spu\u0161t\u011bn\u00ed relace: Teprve po \u00fasp\u011b\u0161n\u00e9m ov\u011b\u0159en\u00ed server dovol\u00ed u\u017eivateli otev\u0159\u00edt termin\u00e1l a zad\u00e1vat p\u0159\u00edkazy pro spr\u00e1vu za\u0159\u00edzen\u00ed.\n", "creation_timestamp": "2026-09-24T19:15:35.000000Z"}, {"uuid": "7ca84e89-5d68-46fd-8130-9e7a107917b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "Telegram/Hf8hl_zhzUyMl8UsZMnGKn7IunUXTVX0mZ-q5flhlwrazgc", "content": "", "creation_timestamp": "2026-09-23T10:51:54.000000Z"}, {"uuid": "e6386be3-ee8d-4798-9ffd-2b16079bf155", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "Telegram/Hf8hl_zhzUyMl8UsZMnGKn7IunUXTVX0mZ-q5flhlwrazgc", "content": "", "creation_timestamp": "2026-09-23T10:51:54.000000Z"}, {"uuid": "57952a4c-6b57-4dc8-98bb-749878d7c23d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "Telegram/XIkBivmGisXgmzkc1XqTQu3LNfVjFJsDCh0uqueLW32BMQ", "content": "", "creation_timestamp": "2026-09-23T22:16:03.000000Z"}, {"uuid": "0d3dfd51-4df4-48b9-84a9-b58f8e0ec4d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "Telegram/SOlT_AM0hTSvAhTjjRrSKpoUrGi7xSQo7lLsQQv6yU_j334", "content": "", "creation_timestamp": "2026-09-25T09:23:05.000000Z"}, {"uuid": "d26bc687-36d6-4986-a868-4d0cbd944427", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "Telegram/XIkBivmGisXgmzkc1XqTQu3LNfVjFJsDCh0uqueLW32BMQ", "content": "", "creation_timestamp": "2026-09-23T22:16:03.000000Z"}, {"uuid": "d290b7c4-13ae-4887-90b9-4bc84d25e32a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "Telegram/SOlT_AM0hTSvAhTjjRrSKpoUrGi7xSQo7lLsQQv6yU_j334", "content": "", "creation_timestamp": "2026-09-25T09:23:05.000000Z"}, {"uuid": "06eae486-e531-4cf2-a8fc-ca3035bb1d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwe37ozitm23", "content": "\ud83d\uded1 CVE-2026-67279\nMikroTik RouterOS\nCVSS 6.9 / EPSS 1% / KEV: No\nTL;DR: RouterOS SSH enters the connection protocol after a client-requested rekey even though us\u2026\nhttps://cvesentinel.com/report/CVE-2026-67279?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-25T15:23:11.591690Z"}, {"uuid": "2dca01a6-beb4-4f74-bcbe-53b14ff1bda1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117332399200664939", "content": "https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog\n\n\nCVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability\n\nCVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability", "creation_timestamp": "2026-09-25T15:32:11.491179Z"}, {"uuid": "812866b7-accb-4bac-a7ae-12cc187d3349", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4213deb1-923e-4318-8fb8-52dc24994b0a", "content": "", "creation_timestamp": "2026-09-25T16:00:01.853985Z"}, {"uuid": "b481ecbd-08dd-4999-b1db-f44be7c33ad2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog", "content": "", "creation_timestamp": "2026-09-25T05:00:00.000000Z"}, {"uuid": "68f6eac9-12d5-4510-9d86-6d42d54471fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/mikrotik-security-advisory-av26-887", "content": "", "creation_timestamp": "2026-09-25T08:33:02.000000Z"}, {"uuid": "ccf68a0c-5105-4be0-b888-f5727153542b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117332796561127193", "content": "CISA has updated the catalogue.\n-  CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=&field_date_added_wrapper=all&sort_by=field_date_added&items_per_page=20\n-  CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-67279\nYesterday:\n- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-71362\n-  CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-5430 #CISA #infosec #vulnerability #Microsoft #Adobe", "creation_timestamp": "2026-09-25T17:13:13.815308Z"}, {"uuid": "a462d8d0-9d0c-4afc-b7b9-18c1f7b16b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://infosec.exchange/users/secdb/statuses/117332745389639847", "content": "\ud83d\udea8 [CISA-2026:0925] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0925)\nCISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.\n\u26a0\ufe0f CVE-2026-65660 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-65660)- Name: Microsoft SharePoint Code Injection Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: Microsoft- Product: SharePoint- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-65660\n\u26a0\ufe0f CVE-2026-67279 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-67279)- Name: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: MikroTik- Product: RouterOS- Notes: https://mikrotik.com/supportsec/september-2026-vulnerability/?utm_source=chatgpt.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67279\n#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260925 #cisa20260925 #cve_2026_65660 #cve_2026_67279 #cve202665660 #cve202667279", "creation_timestamp": "2026-09-25T18:42:43.769958Z"}, {"uuid": "1b15925e-a814-4493-a88c-55421141d476", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://t.me/GithubRedTeam/103358", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-mikrotik-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 15:59:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T16:00:06.000000Z"}, {"uuid": "2375be03-7651-402a-8d96-42bba962bdda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103358", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-mikrotik-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 15:59:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T16:00:06.000000Z"}, {"uuid": "4c9c38a5-47c4-436d-b4e7-7f916b0e9ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "Telegram/81ZxAi3drt5TdyCoeDwTgAnR6u7IKZ42DhAcDrRYmOpRijY", "content": "", "creation_timestamp": "2026-09-26T03:00:05.000000Z"}, {"uuid": "1cba1919-bd15-46e7-bb52-8d99405b149a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwfnvn6ymd2q", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-67279: \u26a0\ufe0f CVE-2026-67279: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.7%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-67279-routeros-ssh-enters-the-connection-protocol", "creation_timestamp": "2026-09-26T06:30:15.125802Z"}, {"uuid": "00b527a4-4720-465e-a7e2-d020ebc6a22b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://t.me/GithubRedTeam/103387", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67279\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 03:56:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T04:00:07.000000Z"}, {"uuid": "58b73204-040f-45ea-9569-1de9babc2118", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103387", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67279\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 03:56:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T04:00:07.000000Z"}, {"uuid": "770c82e0-598f-4230-aec4-11b64a120c0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/dastechno.com/post/3mwg2bj5bpa2x", "content": "SharePoint- und MikroTik-L\u00fccken werden angegriffen: Diese Updates helfen\n\nCISA meldet aktive Angriffe auf SharePoint Server (CVE-2026-65660) und MikroTik RouterOS (CVE-2026-67279). Welche Versionen sicher sind und was Admins jetzt tun sollten.\n\n#News", "creation_timestamp": "2026-09-26T10:11:39.195539Z"}, {"uuid": "76afa23d-4092-4410-b8d7-1e95167d5c62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwgcfaw2zp2v", "content": "\ud83e\udd16 MikroTrick (CVE-2026-67279 + CVE-2026-86060): unauthenticated chain \u2192 full admin on internet-exposed MikroTik RouterOS 7.x, reproduced by Bishop Fox, now in CISA KEV.\nhttps://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html", "creation_timestamp": "2026-09-26T12:36:54.063352Z"}, {"uuid": "c815bab1-de3c-46d6-8b54-ddec6be4a744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117343288774599808", "content": "\ud83d\udcf0 CISA Adds SharePoint, MikroTik Bugs to Known Exploited List\nCISA adds two actively exploited vulnerabilities to its KEV catalog: a SharePoint RCE (CVE-2026-65660) and a MikroTik RouterOS flaw (CVE-2026-67279). Federal agencies must patch by Sep 28. Prioritize remediation now! #CyberSecurity #PatchNow #CISA\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-actively-exploited-sharepoint-and-mikrotik-bugs-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-27T13:41:42.915912Z"}, {"uuid": "683d61c2-4046-4f6f-90b1-894560b8ae1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwiwin33lq2m", "content": "CISA adds two actively exploited vulnerabilities to its KEV catalog: a SharePoint RCE (CVE-2026-65660) and a MikroTik RouterOS flaw (CVE-2026-67279). Federal agencies must patch by Sep 28. Prioritize remediation now! #CyberSecurity #PatchNow #CISA\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-27T13:42:03.412345Z"}, {"uuid": "ea29453a-4f78-459a-afeb-c712c33d02c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103530", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67279-86060-Toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 12:03:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee1\ufe0f CVE-2026-67279 + CVE-2026-86060 \u2013 MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T12:04:05.000000Z"}, {"uuid": "3c42fd17-8a82-4d18-8b8a-efc9ca60f153", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/39e1203d-e3bb-449c-9b33-e54a00b8961c", "content": "", "creation_timestamp": "2026-09-27T17:00:01.701063Z"}, {"uuid": "2af510b4-bf97-4796-a1eb-3ef713fbc241", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkefvnje62z", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 25\uff09\n\nCVE-2026-65660 Microsoft SharePoint\u306e\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\nCVE-2026-67279 Mikrotik RouterOS\u306b\u304a\u3051\u308b\u52d5\u4f5c\u30ef\u30fc\u30af\u30d5\u30ed\u30fc\u306e\u4e0d\u9069\u5207\u306a\u9069\u7528\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-28T03:23:42.568984Z"}, {"uuid": "c442ae72-85ae-4310-841e-7bcd3c746207", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://t.me/baseleeak/404", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "creation_timestamp": "2026-09-28T19:54:03.000000Z"}, {"uuid": "034ad620-f50e-47ca-853f-951f40a55f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "exploited", "source": "https://t.me/baseleeak/404", "content": "4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.\nThe most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0\u20134.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.\nThe flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.\nThe second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.\nAdobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.\nMicrosoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.\nThe fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.\nMikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as \"Flagged\" if it detects known indicators of compromise.\nCISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.\n\n____", "creation_timestamp": "2026-09-28T19:54:03.000000Z"}, {"uuid": "2acfd7a9-6872-4b7c-9c41-ec2b518c9178", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "879fb324-02bd-4be4-b63f-c33bfd62cedb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "content": "", "creation_timestamp": "2026-09-26T15:00:07.000000Z"}, {"uuid": "b9e0109f-f93e-40b9-84af-7c16ca33f5bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "seen", "source": "https://t.me/Russian_OSINT/7977", "content": "\ud83d\udce1 \u0413\u0420\u0427\u0426 \u043f\u043e\u0440\u0443\u0447\u0438\u043b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c MikroTik \u043d\u0430 \u0444\u043e\u043d\u0435 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 RouterOS\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0420\u0411\u041a, \u043f\u043e\u0434\u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0420\u043e\u0441\u043a\u043e\u043c\u043d\u0430\u0434\u0437\u043e\u0440\u0443 \u0413\u043b\u0430\u0432\u043d\u044b\u0439 \u0440\u0430\u0434\u0438\u043e\u0447\u0430\u0441\u0442\u043e\u0442\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0432\u044f\u0437\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 MikroTik \u0432 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0442\u044f\u0445 \u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\n\ud83d\udc46\u041f\u043e\u043b\u044c\u0441\u043a\u0430\u044f CERT Polska \u043e\u043f\u0438\u0441\u0430\u043b\u0430 \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 RouterOS. \u0414\u0432\u0435 \u0438\u0437 \u043d\u0438\u0445, CVE-2026-67279 \u0438 CVE-2026-86060, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 MikroTrick, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 SSH-\u043a\u043b\u044e\u0447\u0430, \u0435\u0441\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 SSH-\u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u041f\u0435\u0440\u0432\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u043a\u0430\u043d\u0430\u043b SSH-\u0441\u0435\u0430\u043d\u0441\u0430 \u0431\u0435\u0437 \u0437\u0430\u0432\u0435\u0440\u0448\u0451\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u0440\u0430\u0432.\n\n\u0412 CERT \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 SSH. \u0421\u0430\u043c\u044b\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0430\u0442\u0430\u043a \u0434\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f 2 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f MikroTik \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 3 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f. \u0412 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u043e\u0442 22 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f CERT Polska \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0443\u0442\u043e\u0447\u043d\u0438\u043b\u0430, \u0447\u0442\u043e CVE-2026-67276, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0432 MikroTrick, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e.\n\n\u0421 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0435\u0441\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043d\u044e\u0430\u043d\u0441. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f RouterOS 6.49.21, 7.23.4 \u0438 7.24.2 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e SSH-\u0446\u0435\u043f\u043e\u0447\u043a\u0443. \u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-67278, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0432 \u0432\u0435\u0442\u043a\u0435 7.x, \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u043d\u0435\u043f\u043e\u043b\u043d\u044b\u043c. \u041f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f CERT Polska \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 7.23.6 \u0438 7.24.3.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 LTE-\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0432\u0435\u0440\u0441\u0438\u0438 7.23.6 \u0438 7.24.3 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u043c\u043e\u0434\u0435\u043c\u0430 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438. MikroTik \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u044d\u0442\u0443 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 7.23.7 \u0438 7.24.4. \u0415\u0441\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0443\u0436\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u043e, \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0442\u0430\u043a\u0436\u0435 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u043c\u043e\u0434\u0435\u043c\u0430 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443.\n\n\u0412 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 CERT \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u044b \u043d\u0430 \u2b55\ufe0f GPT-5.5-cyber \u0438 GPT-5.6-sol. \u041e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c RouterOS \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044e. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u0438 \u043e\u0446\u0435\u043d\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-09-29T06:01:29.000000Z"}, {"uuid": "fdcad09c-18bc-4e0e-b91f-15f53831c14f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "04fe2507-b224-47dc-9af2-bf6c5b1d6ba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "exploited", "source": "https://t.me/Russian_OSINT/7977", "content": "\ud83d\udce1 \u0413\u0420\u0427\u0426 \u043f\u043e\u0440\u0443\u0447\u0438\u043b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c MikroTik \u043d\u0430 \u0444\u043e\u043d\u0435 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 RouterOS\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0420\u0411\u041a, \u043f\u043e\u0434\u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0420\u043e\u0441\u043a\u043e\u043c\u043d\u0430\u0434\u0437\u043e\u0440\u0443 \u0413\u043b\u0430\u0432\u043d\u044b\u0439 \u0440\u0430\u0434\u0438\u043e\u0447\u0430\u0441\u0442\u043e\u0442\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0432\u044f\u0437\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 MikroTik \u0432 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0442\u044f\u0445 \u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\n\ud83d\udc46\u041f\u043e\u043b\u044c\u0441\u043a\u0430\u044f CERT Polska \u043e\u043f\u0438\u0441\u0430\u043b\u0430 \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 RouterOS. \u0414\u0432\u0435 \u0438\u0437 \u043d\u0438\u0445, CVE-2026-67279 \u0438 CVE-2026-86060, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 MikroTrick, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 SSH-\u043a\u043b\u044e\u0447\u0430, \u0435\u0441\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 SSH-\u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u041f\u0435\u0440\u0432\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u043a\u0430\u043d\u0430\u043b SSH-\u0441\u0435\u0430\u043d\u0441\u0430 \u0431\u0435\u0437 \u0437\u0430\u0432\u0435\u0440\u0448\u0451\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u0440\u0430\u0432.\n\n\u0412 CERT \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 SSH. \u0421\u0430\u043c\u044b\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0430\u0442\u0430\u043a \u0434\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f 2 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f MikroTik \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 3 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f. \u0412 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u043e\u0442 22 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f CERT Polska \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0443\u0442\u043e\u0447\u043d\u0438\u043b\u0430, \u0447\u0442\u043e CVE-2026-67276, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0432 MikroTrick, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e.\n\n\u0421 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0435\u0441\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043d\u044e\u0430\u043d\u0441. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f RouterOS 6.49.21, 7.23.4 \u0438 7.24.2 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e SSH-\u0446\u0435\u043f\u043e\u0447\u043a\u0443. \u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-67278, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0432 \u0432\u0435\u0442\u043a\u0435 7.x, \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u043d\u0435\u043f\u043e\u043b\u043d\u044b\u043c. \u041f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f CERT Polska \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 7.23.6 \u0438 7.24.3.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 LTE-\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0432\u0435\u0440\u0441\u0438\u0438 7.23.6 \u0438 7.24.3 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u043c\u043e\u0434\u0435\u043c\u0430 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438. MikroTik \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u044d\u0442\u0443 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 7.23.7 \u0438 7.24.4. \u0415\u0441\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0443\u0436\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u043e, \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0442\u0430\u043a\u0436\u0435 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u043c\u043e\u0434\u0435\u043c\u0430 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443.\n\n\u0412 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 CERT \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u044b \u043d\u0430 \u2b55\ufe0f GPT-5.5-cyber \u0438 GPT-5.6-sol. \u041e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c RouterOS \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044e. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u0438 \u043e\u0446\u0435\u043d\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-09-29T06:01:29.000000Z"}, {"uuid": "ca2b18c2-155c-48f7-af6f-8c65c9ee6c28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67279", "type": "published-proof-of-concept", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "content": "", "creation_timestamp": "2026-09-26T15:00:07.000000Z"}]}