cve recordzero day2 of 3 cataloguesexploit reported

CVE-2026-67276

CVSS—

Severitynone

Weakness—

EPSS6.5%93.7th percentile

Exploited2 KEV sources

patch window

Called exploited the same day it was disclosed.

Measured from the CVE publication date to the earliest of 2 KEV catalogues that list it.

The life of this vulnerability

CVE publishedSep 5, 2026
First KEV listingSep 5, 2026same day
Last sightingSep 6, 20261d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Unionlisted Sep 5, 2026
VulnCheck KEVcommercial researchlisted Sep 5, 2026
CIRCLaggregator, mirrors the abovelisted Sep 5, 2026, not counted

Sources2 of 3

Listings differ by0 d

Strongest claimconfirmed

2 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

exploitedSep 5, 2026vulnerability.circl.lu/known-exploited-vulnerabilities-catal
seenSep 6, 2026Telegram/iJR95E8kv61jfY2vytdD0YiVw2BBATVelGZktxN4BZZcfkCA
seenSep 5, 2026bsky.app/profile/stemshop.bsky.social/post/3musihjvedt2f
seenSep 5, 2026bsky.app/profile/stackflag.bsky.social/post/3muse5sihmx2j

4 public reports collected from VulnCheck and CIRCL, first on Sep 5, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-67276

CVE-2026-67276Sep 6, 2026critical

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik has issued an urgent advisory for its RouterOS, confirming active exploitation of a critical vulnerability chain, dubbed "MikroTrick," that allows unauthenticated attackers to gain full control of devices with SSH exposed to the internet. The company released patches on September 3, 2026, but evidence suggests exploitation began as early as September 2, making it a zero-day event.