MikroTik RouterOS SSH pre-auth rekey abuse (CVE-2026-67279)

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•5

This rule detects potential attempts to exploit an SSH pre-authentication rekey or authentication bypass vulnerability (CVE-2026-67279) in MikroTik RouterOS devices. It monitors incoming TCP traffic on port 22 that contains the 'ROSSSH' signature followed by specific binary sequences indicative of exploitation attempts.