MikroTik Network equipment company which makes routers, switches, access points, etc.

Known Exploited MikroTik Vulnerabilities

The following MikroTik vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 12 vulnerabilities in MikroTik with an average score of 7.6 out of ten. Last year, in 2025 MikroTik had 7 security vulnerabilities published. That is, 5 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.80

Recent MikroTik Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-86060	Sep 05, 2026	RouterOS 6.x/7.x Privilege Escalation via Username Arg Flip in SSH RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)	Routeros
CVE-2026-67281	Sep 05, 2026	RouterOS WebFig Unauth File-Read via /jsproxy Stale Pointer (6.49.21+) RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)	Routeros
CVE-2026-67279	Sep 05, 2026	RouterOS SSH Rekey Escalation Enables Unauthenticated Exec in 6.x/7.x RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)	Routeros
CVE-2026-67278	Sep 05, 2026	MikroTik RouterOS TLS Forgery: RSA PKCS#1 v1.5 Signature (e=3) Pre-6.49.21 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the roots public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)	Routeros
CVE-2026-67277	Sep 05, 2026	RouterOS: btest Conn Auth Gap & IPv4 UDP Test Int Underflow (7.24.2) RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)	Routeros
CVE-2026-67276	Sep 05, 2026	RouterOS RSA Exponent Omission Enables SSH Auth Bypass (pre-6.49.21/7.23.4/7.24.2) RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)	Routeros
CVE-2026-14227	Jul 30, 2026	RouterOS API Insufficient Session Exp Exp (CVE-2026-14227) An API sessionmanagement flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or usergroup changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.	Routeros
CVE-2026-16347	Jul 28, 2026	MikroTik RouterOS API lacks ratelimiting, enabling bruteforce attacks MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.	Routeros
CVE-2026-39042	Jul 13, 2026	DoS via libumsg.so unflatten() in MikroTik RouterOS 7.21.x before 7.21.4 An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.	Routeros
CVE-2024-27686	May 08, 2026	Mikrotik RouterOS SMB DoS v6.40-6.49 (fixed in 7) Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445.	Routeros