RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request; on affected builds the server dispatches the command, enabling unauthenticated creation, overwrite and reconstruction of files in the RouterOS managed file namespace. CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities catalog on 25 September 2026 on evidence of active exploitation, with a remediation deadline of 28 September. Its CVSS 4.0 base score is 6.9, which makes it the useful reminder that KEV urgency does not track severity: a medium-rated bypass carries the same three-day federal clock as the high-rated SharePoint code injection (CVE-2026-65660) added the same day.