Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

CVE-2026-67279 is a vulnerability in Mikrotik RouterOS involving improper enforcement of behavioral workflow. It allows an unauthenticated client to open a session channel and send an exec request without authentication. This vulnerability can be chained with CVE-2026-86060 to achieve full unauthenticated exploitation of affected devices. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements are also outlined under the BOD 26-04 implementation guidance. Mikrotik has published a security advisory for September 2026 addressing this issue. The vulnerability is tracked in the NVD under CVE-2026-67279. The current risk level is assessed as High, indicating active concern and urgency for patching.