Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation
Polish CERT has publicly disclosed three vulnerabilities affecting MikroTik routers, two of which are already being exploited in the wild. The issues were found in devices that allow SSH access from the internet, with more than 122,000 potentially vulnerable routers observed online as of September 5.
The two most severe flaws both carry a CVSS score of 9.2. CVE-2026-67276 permits an attacker who knows a valid username and the public-key module to bypass SSH authentication entirely. CVE-2026-86060 enables privilege escalation when a username containing malformed characters is supplied. When chained, the pair allows complete compromise of the router.
A third vulnerability, CVE-2026-67277 (CVSS 8.8), exists in the internet-connection speed-test service and can be abused to trigger a denial-of-service condition. The flaws were initially identified by automated analysis using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol, with subsequent manual confirmation by researchers.
Exploitation activity began at the same time MikroTik released patches. Updated firmware is available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. The vendor also enhanced built-in detection of prior compromise; affected devices now produce characteristic log entries such as “login failure for user -2 from ‘ip’ via ssh” and “user ‘name’ added by ssh:-2@‘ip’”.
Additional security updates released last week include a critical fix for a VoIP stack flaw in WeChat that enabled the creation of the self-propagating WeWorm, a record 972-patch Microsoft release containing two zero-days, 230 patches from Google that addressed an actively exploited Chrome vulnerability, and fixes for path-traversal issues in GitLab as well as Adobe Commerce and Magento.
Related articles
Yookassa Webhook Flaw Allowed Forging Payment Confirmations via Single Curl Request
A technical audit of a car rental service uncovered a critical flaw in the Yookassa webhook handler where payment.succeeded events were trusted without verification. The endpoint accepted the event type and gateway_payment_id directly from the client-supplied payload, enabling attackers to mark pending bookings as paid using a simple unauthenticated POST request. The vulnerability existed because the integration did not use Yookassa's optional Webhook-Signature mechanism and avoided IP allowlisting due to proxy infrastructure concerns. Developers addressed the issue by implementing a reverse API call to fetch authoritative payment status from Yookassa before updating records, ensuring fail-closed behavior on errors. New tests cover forgery attempts, amount mismatches, and idempotency, while several additional hardening measures were deliberately deferred to keep the patch minimal and reviewable. The original unit tests had masked the problem by simulating trusted input rather than validating source authenticity.
Password Deleted from Git but Still Present: Major CI/CD Security Mistakes
Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.
Critical SSRF Vulnerability in AWS SSM Agent Allows IAM Credential Theft via Port Forwarding Bypass
Amazon Web Services has disclosed a high-severity server-side request forgery vulnerability in the AWS Systems Manager Agent. The flaw, tracked as CVE-2026-89049, affects the port forwarding feature used by Session Manager and stems from insufficient validation that permits bypass of deny-list restrictions on link-local addresses. Successful exploitation requires port-forwarding permissions but can lead to unauthorized access to instance metadata and temporary IAM role credentials. The company rated the issue as Important with CVSSv4.0 base score 8.5 and CVSSv3.1 score 9.9. The vulnerability was addressed in version 3.3.4851.0 released on 13 July 2026, prior to the public advisory issued on 10 September 2026.
New Windows 11 Bypass Lets Users Skip Internet and Microsoft Account During Setup
A new method has been discovered that allows Windows 11 Home users to complete initial setup without an internet connection or Microsoft account. The technique requires no command-line tools or scripts and was found by enthusiast Bob Pony. During the OOBE process, users simply open the sign-in options and click the Learn more link, which redirects the wizard to local account creation. Previous bypasses such as OOBE\bypassnro and start ms-cxh:localonly have already been blocked by Microsoft. The new approach appears to be an overlooked interface element and works only on the Home edition. Microsoft is expected to close this loophole in a future update as it continues tightening account requirements.