CVE-2026-67279 IBM QRadar · QRadar

Detect MikroTik RouterOS Improper Behavioral Workflow Enforcement (CVE-2026-67279) in IBM QRadar

Detects exploitation and post-exploitation activity associated with CVE-2026-67279, a CISA KEV-listed improper enforcement of behavioral workflow vulnerability (CWE-841) in MikroTik RouterOS. Attackers abuse out-of-order or state-skipping requests against RouterOS management services (Winbox/8291, API/8728, www/443, SSH) to bypass authentication and configuration workflow controls, enabling device takeover, credential extraction, and pivoting. This detection surfaces anomalous RouterOS management-plane access, workflow-bypass indicators, unexpected admin/config changes, and outbound C2 from edge devices. Chained with related MikroTik flaws it allows full device compromise per September 2026 vendor advisory.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, COUNT(*) AS attempts, UNIQUECOUNT(destinationport) AS distinct_ports FROM events WHERE destinationport IN (8291, 8728, 8729, 22, 443, 80) AND (LOWER("DeviceVendor") LIKE '%mikrotik%' OR LOWER(payload) LIKE '%routeros%' OR destinationport IN (8291,8728,8729)) GROUP BY sourceip, destinationip HAVING distinct_ports >= 2 OR attempts > 50 ORDER BY attempts DESC LAST 24 HOURS
high severity medium confidence

Aggregates management-plane access to RouterOS devices to flag multi-port or high-volume connection patterns associated with CVE-2026-67279 exploitation.

Data Sources

FirewallNetwork SessionSyslog

Required Tables

events

False Positives & Tuning

  • Legitimate bulk RouterOS administration from a NOC host
  • Automated config-backup polling
  • Authorized vulnerability scans of edge routers

Other platforms for CVE-2026-67279

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Winbox port probe against RouterOS

    Expected signal: Firewall/NetFlow records showing connections to ports 8291 and 8728 on the RouterOS device from the test host.

  2. Test 2Multi-service management sweep

    Expected signal: Sequential inbound connection events to multiple RouterOS management ports from a single source within a short window.

  3. Test 3High-volume Winbox connection burst

    Expected signal: 60+ short-lived connection events to port 8291 on the RouterOS device from one source IP.

Last updated: 2026-09-26 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the destination device is a MikroTik RouterOS system and identify its current RouterOS version against the September 2026 vendor advisory to determine patch status.
  2. Review the source IP reputation and geolocation; determine whether it belongs to a known administrator/NOC range or is external/untrusted.
  3. Inspect RouterOS logs (System > Log, /log print) for successful logins, config changes, new users, scripts, or scheduler entries created around the alert window.
  4. Correlate the management-port access with any subsequent outbound connections from the router to unusual destinations (possible C2 or SOCKS proxy tunneling).

Containment

  1. Restrict RouterOS management interfaces (Winbox 8291, API 8728/8729, www, SSH) to trusted source IPs via firewall address-lists, or disable unused services entirely.
  2. Isolate or take the affected router offline if compromise is confirmed, and fail over to a known-good backup device where possible.
  3. Force-rotate all RouterOS admin credentials and revoke any attacker-created accounts, scripts, and scheduler tasks.

Evidence Collection

  1. Export the full RouterOS configuration (/export) and log history (/log print) for forensic comparison against last known-good backups.
  2. Capture packet traces or firewall session logs for the source IP to management ports for the exploitation timeframe.

Escalation Criteria

  • !Escalate to incident response if unauthorized configuration changes, new admin users, scripts, or scheduler entries are found on the device.
  • !Escalate immediately if the router is observed initiating outbound C2, tunneling, or lateral movement into internal networks.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >RouterOS system log entries (/log print) showing logins, config changes, and service restarts
  • >RouterOS user database, scripts, and scheduler entries (/user print, /system script print, /system scheduler print)
  • >Firewall/NetFlow session records for management-port access and subsequent outbound flows from the router

Tuning Guidance

Baseline your legitimate RouterOS administration sources (NOC jump hosts, backup/monitoring tools) and exclude them via allow-lists. Adjust the multi-port and volume thresholds to your environment's normal management cadence, and prioritize alerts where source IPs are external or where management access is followed by configuration changes or outbound connections from the router.

Hunting Queries

Hunts for hosts generating unusually high volumes of Winbox/API connections to RouterOS devices, indicating scanning or brute-force preceding CVE-2026-67279 exploitation.

Hunting — KQL
kql 
CommonSecurityLog | where DestinationPort in (8291,8728,8729) | summarize c=count() by SourceIP, DestinationIP, bin(TimeGenerated, 1h) | where c > 30
Hunting — SPL
spl 
index=network dest_port IN (8291,8728,8729) | stats count by src_ip dest_ip | where count>30

Atomic Red Team Tests

Test 1 Winbox port probe against RouterOS
linux

Simulates reconnaissance by probing the RouterOS Winbox management port from an untrusted host.

Command

bash 
nc -vz -w 3 ROUTER_IP 8291; nc -vz -w 3 ROUTER_IP 8728

Cleanup

bash 
No persistent artifacts; clear shell history if desired: history -c

Expected Telemetry

Firewall/NetFlow records showing connections to ports 8291 and 8728 on the RouterOS device from the test host.

Expected Detection

KQL/SPL multi-port management-access rule fires on distinct_ports>=2 from the test source IP.

Test 2 Multi-service management sweep
linux

Sequentially touches Winbox, API, SSH, and HTTPS management services on a RouterOS device to emulate the chained access pattern of CVE-2026-67279.

Command

bash 
for p in 8291 8728 22 443; do nc -vz -w 2 ROUTER_IP $p; done

Cleanup

bash 
No persistent artifacts created; history -c

Expected Telemetry

Sequential inbound connection events to multiple RouterOS management ports from a single source within a short window.

Expected Detection

Elastic EQL sequence rule and multi-port aggregation rules alert on the sequential management-plane access.

Test 3 High-volume Winbox connection burst
linux

Generates a burst of repeated Winbox connections to trigger volume-based detection of exploitation/brute-force activity.

Command

bash 
for i in $(seq 1 60); do (echo > /dev/tcp/ROUTER_IP/8291) 2>/dev/null; done

Cleanup

bash 
No files created; history -c

Expected Telemetry

60+ short-lived connection events to port 8291 on the RouterOS device from one source IP.

Expected Detection

Aggregation rules fire when attempts exceed the configured volume threshold (>50).

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1133External Remote ServicesT1556Modify Authentication Process

Same Tactic: Initial Access

Popular Detections