MikroTik RouterOS CVE-2026-14227

Two concurrent conditions are required: first, the RouterOS API service must be explicitly enabled on the target device (it is not universally on by default and must be activated under IP > Services); second, the attacker must hold a currently active, authenticated session established with high-privilege credentials prior to the permission-reduction event. The specific trigger is a post-authentication state change - either the administrator modifies the attacker's user group to lower permissions, or an inactivity timeout is expected to invalidate the session - but the server does not enforce re-authorization on the existing token. Exploitation is strictly limited to authenticated users with prior high-privilege access; an unauthenticated external party cannot exploit this flaw. The exploitation window is bounded by the natural session lifecycle and closes once the stale session terminates; devices with the API service disabled are not affected.

The CVSS 4.0 score of 6.9 (Medium) is shaped primarily by the PR:H prerequisite, which dramatically constrains the exploitable population to actors who already hold valid high-privilege RouterOS API credentials. The high confidentiality impact (VC:H) reflects the sensitivity of what a stale privileged session can expose - full routing tables, firewall rulsets, VPN pre-shared keys, and user credential hashes accessible via the API. No EPSS score was provided in the source intelligence, and the vulnerability is neither in the CISA KEV catalog nor associated with public proof-of-concept code, suggesting it has not been observed in widespread active exploitation. The realistic threat model is an insider or post-incident scenario: a user whose API credentials were demoted (e.g., following a suspected compromise or role change) retains their prior access window until the session naturally lapses. ICS-CERT's involvement elevates organizational priority specifically for OT operators - MikroTik is common in industrial DMZ and plant-network segments where session integrity is a compliance concern. Integrity and availability are unaffected (VI:N, VA:N), making this a targeted information-disclosure risk rather than a system-compromise vector.

A network administrator removes elevated privileges from a RouterOS API user account - for example, revoking read access to the firewall and VPN configuration sections - but the user's active API session token remains valid on the server side. During the window between the permission change and natural session expiration, the demoted user continues to issue API commands to read firewall rules, extract BGP neighbor credentials, or enumerate VPN pre-shared keys that should now be out of scope. No public exploit code has been identified; successful exploitation requires the adversary to already hold a currently active, authenticated high-privilege session at the moment their access is reduced.