Severity Daily

IT and AI security incidents, checked against the primary source

Tag: CVE-2026-67277

  • In three of today’s eight stories, the fix on offer covers less than the flaw does

    In three of today’s eight stories, the fix on offer covers less than the flaw does

    The most consequential thing on the site today is not the 10.0. It is a three-day federal clock that runs out on Sunday. CISA added two of the three exploited MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog on September 10, due September 13, and left off the SSH authentication bypass that CERT Polska puts first in the chain. Exploitation is confirmed by a national CERT, all three flaws are closed by the same RouterOS releases, and Shadowserver counts at least 122,500 MikroTik devices with SSH reachable per 24-hour scan window. An agency that upgrades is fine. An agency that works the catalog as a queue — patch what is listed, ticket what carries a due date — finishes Sunday compliant and still reachable through the door the catalog does not name.

    The biggest-sounding story is GitLab’s, and it ranks second. An unauthenticated arbitrary file read in the repository commits API, scored 10.0, is as bad as a number gets, and the research published on September 11 describes reaching configuration files, credentials, tokens, and SSH keys. But nobody has confirmed exploitation — watchTowr reports probes, and probing is not exploitation — and the 10.0 is GitLab’s own, with NVD returning no record at all as of early this morning. Recompute the vector without the integrity impact the advisory’s own description does not describe, and it is an 8.6. What is not in dispute is the work: self-managed operators have a critical to install, and some of them cannot.

    That last clause is the day’s thread, and it runs through three of the eight stories. GitLab names installations from 18.7 as affected and ships no 18.x build in the release, so a shop sitting on 18.7 through 18.11 is inside the affected range and outside the branch that got the fix — a major-version migration, not a patch. CISA put two more JFrog Artifactory flaws on KEV with a September 25 deadline, and on the 7.133 branch their fixes are seventeen patch releases apart: an administrator who took 7.133.11 in July to close CVE-2026-42016 is still exposed to CVE-2026-42018 today, and a version check that stops at 7.133.11 reports the box clean. And CISA’s MikroTik entries cover two links of a three-link chain. In each case the fix on offer covers less than the flaw does, and in each case you see it only by reading two documents side by side.

    The other four are disclosure stories, and what they share is an absence. Florida’s motor vehicle agency confirmed that DAVID, its law enforcement driver database, was breached through credentials a Plant City police employee stored on a personal device, and named no number; every figure in circulation — 200,000 records, Social Security numbers, and dates of birth — belongs to ShinyHunters. Nutex Health’s stolen data has been published online, and the company filed that under Item 8.01 with its materiality assessment unchanged, no count and no dates. Conduent settled the class action over its January 2025 breach with no dollar figure, also under Item 8.01, having filed the incident itself under Item 1.05. Greenberg Traurig told Vermont and California regulators that Social Security numbers were in scope on September 8 and September 9, then publicly called the exposure limited on September 10. Furthest from an action item, Anthropic’s misuse report describes one actor working through roughly thirty AI companies in about four days, swapping in each victim’s own API keys as it went — a billing and attribution problem as much as a security one.

    Open tonight. CVE-2026-67276, the MikroTik bypass, still carries no exploit-add date and may yet be added; worth re-checking before Sunday. CISA’s alert for September 11 is titled as one catalog addition while two records carry that day’s exploit-add date, and cisa.gov returns 403 to automated fetching, so the count could not be reconciled. GitLab has said nothing about the 18.x case. The distillation claim circulating in coverage of the Anthropic report — seven named Chinese labs, industrial scale — does not appear in the document we read. And four organizations described a breach today without producing a number. Nutex says its review will take several weeks.

  • CISA puts two of the three exploited MikroTik RouterOS flaws on KEV with a Sunday deadline, and leaves the SSH bypass that opens the chain off it

    CISA puts two of the three exploited MikroTik RouterOS flaws on KEV with a Sunday deadline, and leaves the SSH bypass that opens the chain off it

    CISA added two of the six September MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog on September 10, with a federal remediation deadline of September 13 — and the SSH authentication bypass that CERT Polska says attackers use to get in is not one of them.

    What happened

    On September 10, 2026, CISA added two MikroTik RouterOS vulnerabilities to the Known Exploited Vulnerabilities catalog. NVD’s republication of the catalog data carries, for both records, a cisaExploitAdd of 2026-09-10 and a cisaActionDue of 2026-09-13. That is a three-day clock, and it lands on Sunday, September 13.

    The two are:

    • CVE-2026-86060, which CISA names “MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability.” NVD scores it 9.2 critical on CVSS 4.0 and classes it CWE-88. The record describes “an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation.”
    • CVE-2026-67277, which CISA names “MikroTik RouterOS Missing Authentication for Critical Function Vulnerability.” NVD scores it 8.8 high on CVSS 4.0 and classes it CWE-306. It sits in the bandwidth-test service: RouterOS “accepts unauthenticated ‘related’ btest connections before primary session authentication completes,” leaking uninitialized kernel packet buffer data when random-data=false, and an unchecked inverted packet-size interval triggers an unsigned integer underflow that can restart the kernel.

    The required action CISA attaches is the standard BOD 26-04 text. On the CVE-2026-67277 record it reads, verbatim: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.” The CVE-2026-86060 record carries the same required-action boilerplate.

    Severity Daily covered the underlying disclosure on September 5, in MikroTik withheld the RouterOS advisory to buy patching time, and working exploits were published the next day. That story is the background; the KEV addition and the federal deadline are what is new.

    The half of the chain that is not on the catalog

    CERT Polska’s September 5 writeup, the primary account of the exploitation, describes three flaws and a chain. CVE-2026-67276 is an SSH authentication bypass: RouterOS compares the key type and modulus of an RSA public key but omits the exponent, so an attacker who knows an authorized modulus can present a key with exponent one, forge a signature, and open an SSH command channel as that user without holding the private key. CVE-2026-86060 is the privilege escalation that follows. CVE-2026-67277 is the bandwidth-test memory disclosure and crash.

    CERT Polska’s language is that the chain was “exploited to take full control of devices” reachable over SSH. In that account the authentication bypass is the door and the argument-delimiter flaw is what happens after the attacker is through it.

    CVE-2026-67276 is not in the catalog. Its NVD record carries no cisaExploitAdd, no cisaActionDue, and no cisaVulnerabilityName, while both of its neighbors now do. NVD scores it 9.2 critical — the same score as CVE-2026-86060, and higher than CVE-2026-67277, which was added.

    We do not know why. CISA does not publish its reasoning for individual additions, and an absence from the catalog is not a statement that a flaw is unexploited. It may yet be added; NVD lags the catalog by hours, and this record is one worth re-checking. But as of this writing the catalog obliges federal agencies to remediate the escalation and the crash on a three-day clock while saying nothing about the bypass that CERT Polska puts first in the sequence.

    Why it matters

    The practical effect is small for anyone patching properly, because all three flaws are fixed by the same RouterOS releases. An agency that upgrades to close CVE-2026-86060 closes CVE-2026-67276 in the same step, whether or not the catalog asked it to. The risk is not to the organization that patches the box. It is to the organization that works the catalog as a list.

    That is a real operating model. Plenty of vulnerability programs treat KEV as the queue: the scanner tags what is listed, the ticket cites the due date, and what is not listed waits for the ordinary monthly cycle. For a shop that mitigates rather than upgrades — restricting bandwidth-test, filtering SSH by source, tightening a firewall rule to satisfy the specific finding in front of it — a catalog naming two of three chain links produces a device that is compliant and still reachable. This is the same shape Severity Daily has filed before as a chain scored below the chain it enables: the record decomposes an attack into parts and then rates the parts, and the sum is not preserved.

    The scale here is what makes it worth saying out loud. The Shadowserver Foundation added MikroTik SSH identification to its daily scans on September 4 and reported “at least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05.” That is exposure, not compromise, and it is not a count of vulnerable devices — Shadowserver cannot tell patched from unpatched from the outside, and neither can we. But it is the honest denominator for a flaw whose precondition is SSH reachable from the internet, and it is six figures.

    The other thing worth noticing is the shape of the timeline. MikroTik published its advisory on September 3 and deliberately withheld detail: “To give time to update your systems, we are not currently publishing detailed information.” Working exploits were public on September 4. CERT Polska published on September 5 and dated the earliest attack traffic it saw to at least September 2 — before the patch. The catalog addition came on September 10, eight days after the first observed exploitation and seven days after the fix was available. Federal agencies now have three days from that addition. The window that mattered closed a week before the clock started, which is an argument for treating a vendor advisory with a withheld-detail notice as its own signal rather than waiting for the catalog to confirm it.

    What to do

    Upgrade. MikroTik’s fixed releases are 7.25 beta 3, 7.24.2, 7.23.4 (long-term), and 6.49.21. CVE-2026-67276 affects only the 7.x branch and is fixed in 7.23.4 and 7.24.2; the other two reach back into 6.x, which is why 6.49.21 exists. Upgrading closes all three whatever the catalog lists.

    If you cannot upgrade today, the mitigation MikroTik names is to keep SSH off untrusted networks and reach management over a VPN rather than an open port. Treat that as a stopgap for the SSH-borne flaws only — it does nothing for the bandwidth-test issue, which rides UDP.

    Then check for compromise, because exploitation predates the patch. CERT Polska’s indicators are specific: log entries reading login failure for user -2, log entries of the form user <name> added by ssh:-2@<ip>, and the presence of a privileged account named ops. The attack traffic CERT Polska observed came from 82.192.72.4, seen since at least September 2, and 103.102.31.18. MikroTik’s own advice after upgrading is to inspect the configuration for unknown scripts, users, or unrecognized settings, and to review logs for entries marked “Flagged.”

    Federal civilian agencies: the due date on both catalog entries is September 13, 2026, and the required action text points at BOD 26-04’s forensic triage requirements as well as remediation. Given that exploitation was observed before the fix shipped, the triage half is the part that actually earns its keep here.

    Sourcing note

    KEV dates for CVE-2026-86060 and CVE-2026-67277 were read from NVD’s API records for each CVE, which republish CISA’s own cisaExploitAdd, cisaActionDue, cisaVulnerabilityName, and cisaRequiredAction fields. cisa.gov returns 403 to automated fetching, so CISA’s alert page for the addition was not read directly; its existence and title, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” dated September 10, 2026, came from a search result and a third-party republication, and the CVE identities and dates were then confirmed one record at a time against NVD. The catalog mirror at cisagov/kev-data was fetched but truncates well before the end of the file and is not usable for enumerating recent additions; an attempt to do so returned a wrong answer, as it has before.

    NVD’s own lag was visible during reporting. On a first read on the morning of September 11, CVE-2026-67277’s record showed a lastModified of 2026-09-09T05:17:28.263 and carried no CISA fields at all. A second read minutes later returned lastModified of 2026-09-11T12:52:29.533, status “Analyzed,” and the full CISA block. Both values are reported here rather than only the later one. CVE-2026-67276’s record was re-read on the afternoon of September 11 and still carried no CISA fields, with a lastModified of 2026-09-09T05:17:28.130 and a status of “Awaiting Analysis.”

    The vulnerability descriptions and CVSS 4.0 scores are NVD’s. CERT Polska’s advisory of September 5, 2026, is the source for the chain, the attacker IP addresses, and the indicators of compromise. MikroTik’s “September 2026 vulnerability” advisory of September 3, 2026, is the source for the fixed versions and the quoted vendor language. The 122,500 figure is the Shadowserver Foundation’s, posted September 6, 2026, and is a count of MikroTik devices with SSH reachable during a 24-hour scan window on September 5 — not a count of vulnerable or compromised devices.

    Unresolved: whether CVE-2026-67276 will be added to the catalog, and CISA’s reasoning for listing two of the three flaws CERT Polska describes. No count of compromised devices has been published by anyone. Attribution has not been established and is not asserted here.