What happened

On 6 October 2026, MikroTik updated its September security bulletin to clarify that the initial fix for CVE-2026-67278 was incomplete. The vulnerability involves the acceptance of forged TLS certificates and SSH host keys. The fixes in RouterOS 7.24.2 and 7.23.4 did not fully address it; the vendor identifies 7.24.3 in the stable channel and 7.23.6 in the long-term channel as containing the complete fix. RouterOS 6 is not affected by this particular issue. [1]

CERT Polska has separately reported active exploitation of an SSH vulnerability chain covered by the same bulletin. Its recommendations now include the corrected releases and checks for unauthorized changes to device configuration. [2]

Why it matters for manufacturers

A security update can install correctly yet fail to fully address a vulnerability. For certificate verification, tests should show that invalid peers are rejected while legitimate connections continue to work.

A revised advisory creates follow-up work across supported branches. Teams need to identify which images included the original fix, which products received those images, and which branches contain the complete correction. Release records that link source changes, firmware images, tests, and deployed versions make that assessment easier.

Continue monitoring advisories after a CVE has been marked as patched. Corrected version tables and follow-up upstream changes may require further action.

What to include in release review

  • Check previously approved firmware versions against the corrected releases listed for their release channel.
  • Retain tests for the specific vulnerability alongside regular connectivity and regression checks.
  • Link each follow-up fix to the original change, its validation results, and the affected product releases.

The engineering takeaway

Preserve evidence showing what a patch fixes and how it was tested. If an advisory changes, that record helps engineers identify affected releases and determine the scope of the follow-up work.

Primary sources

  1. MikroTik: September 2026 vulnerabilityPublished on 3 September 2026. Correction dated 6 October 2026.
  2. CERT Polska: Critical vulnerabilities in MikroTik RouterOS are being actively exploitedPublished on 5 September 2026. Current recommendations reviewed on 13 November 2026.

Sources reviewed on . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.