Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation
Polish CERT has publicly disclosed three vulnerabilities affecting MikroTik routers, two of which are already being exploited in the wild. The issues were found in devices that allow SSH access from the internet, with more than 122,000 potentially vulnerable routers observed online as of September 5.
The two most severe flaws both carry a CVSS score of 9.2. CVE-2026-67276 permits an attacker who knows a valid username and the public-key module to bypass SSH authentication entirely. CVE-2026-86060 enables privilege escalation when a username containing malformed characters is supplied. When chained, the pair allows complete compromise of the router.
A third vulnerability, CVE-2026-67277 (CVSS 8.8), exists in the internet-connection speed-test service and can be abused to trigger a denial-of-service condition. The flaws were initially identified by automated analysis using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol, with subsequent manual confirmation by researchers.
Exploitation activity began at the same time MikroTik released patches. Updated firmware is available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. The vendor also enhanced built-in detection of prior compromise; affected devices now produce characteristic log entries such as “login failure for user -2 from ‘ip’ via ssh” and “user ‘name’ added by ssh:-2@‘ip’”.
Additional security updates released last week include a critical fix for a VoIP stack flaw in WeChat that enabled the creation of the self-propagating WeWorm, a record 972-patch Microsoft release containing two zero-days, 230 patches from Google that addressed an actively exploited Chrome vulnerability, and fixes for path-traversal issues in GitLab as well as Adobe Commerce and Magento.
Related articles
Telegram Patches RCE Vulnerabilities in HTML Widgets After Researcher Demonstrates Calculator Exploit
Telegram introduced HTML widgets for bots in early November, allowing JavaScript execution inside messages via the QuickJS engine. Security researcher V12 quickly demonstrated remote code execution by launching the system calculator on Android. Pavel Durov responded that no vulnerability existed because the user had to first start the bot, yet server-side fixes were deployed anyway. Multiple use-after-free and use-after-return bugs were identified in QuickJS and QuickJS-ng, some discovered with AI assistance from Claude Fable 5.1 and Mythos 5.2. Telegram isolated the widget engine into a separate process on Android, added syscall filtering, and limited nested graphical effects to prevent crashes. Desktop clients received the fixes across versions 7.4.2 and 7.4.3, while widgets were temporarily restricted server-side. Users are advised to update to Android 13.2.2 or Desktop 7.4.3 and avoid unknown bots.
Telegram Patches Critical QuickJS Sandbox Escape Vulnerability in Android Update 13.2.2
Telegram has released version 13.2.2 for Android to address a high-severity vulnerability in its HTML widgets for bots. The flaw resided in the QuickJS JavaScript engine within Telegram's QuickJS-ng fork and allowed scripts in ordinary messages to break out of the sandbox and execute native code on the device. The root cause was improper handling of the await using construct inside non-async functions, which triggered a use-after-return condition by freeing local variable references while nested functions still accessed the stack. The vulnerable code entered the QuickJS-ng main branch on May 16 as part of explicit resource management support. Security researcher Andreas Rösler discovered the issue during an AI-assisted audit with Anthropic's Claude model that identified 27 findings total. The patch enforces a syntax error on the invalid construct and was merged on November 10, the same day the Android release became available. Although reported against Android 13.2.1, the bug affected every platform using the affected engine fork.
Node.js Patches 16 Vulnerabilities Exposing TLS Private Keys and Cross-Connection Data
The Node.js project has released fixes addressing 16 vulnerabilities, seven of which are rated high severity. The most critical issue, CVE-2026-123864, allows an unauthenticated client to read memory from other HTTPS connections, potentially exposing TLS private keys and requests belonging to other users. Three supported release lines were affected, and exploitation requires a specific application code pattern involving res.flushHeaders() and res.end() calls before the request body is fully received. Additional high-severity flaws include CVE-2026-123863, which crashes HTTP/2 servers, CVE-2026-123866 that leaks server memory chunks to clients, and CVE-2026-123865 that causes permanent memory and file descriptor leaks in HTTP/2 servers. Several other CVEs affect TLS renegotiation, SNI callbacks, and file streaming functions. The project states that end-of-life branches including 20.x and 25.x remain vulnerable with no patches available.
Microsoft Confirms November Windows Updates Break Activation, Licensing and Printing Functions
Microsoft has acknowledged that its November 2024 cumulative updates are causing failures in Windows activation and licensing operations on multiple supported platforms. The Software Licensing Management Tool (SLMGR) returns error 0x80041008 when administrators run commands such as slmgr.vbs /skms-domain or slmgr.vbs /ipk, preventing product activation, KMS server configuration, and product key changes. The issue affects Windows 11 23H2, Windows 10 22H2, Windows 10 21H2, Windows Server 2025, Windows Server 2022, and Windows Server 2019. A separate regression introduced by the same updates prevents printing of documents that contain images with zero height or width, a technique used for watermarks in Microsoft Word and other applications. Microsoft stated that a fix will be released in the coming days and advised enterprise customers needing an immediate workaround to contact business support.