Which versions of MikroTik RouterOS are affected by EUVD-2026-26801?

CVE-2026-7668 is a memory disclosure vulnerability in MikroTik RouterOS 6.49.8 that allows unauthenticated remote attackers to read sensitive data and disrupt service through the SCEP endpoint.

Is there a public PoC exploit available for EUVD-2026-26801?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26801. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-26801?

Within 24 hours: Identify all RouterOS 6.49.8 deployments and isolate affected devices from untrusted networks; document current firmware version inventory. Within 7 days: Implement network access controls restricting SCEP endpoint (port 80/443) to authorized clients only; monitor for exploitation attempts targeting transactionID and messageType parameters. Within 30 days: Upgrade to RouterOS 6.49.9 or later if available; if unavailable, evaluate migration to alternative vendor or implement reverse proxy with request validation and rate limiting on SCEP endpoints.

MikroTik RouterOS EUVD-2026-26801

Q: What is the CVSS score of EUVD-2026-26801?

EUVD-2026-26801 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7668 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-02 VulDB

Information Disclosure Buffer Overflow Mikrotik

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 02, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

May 02, 2026 - 21:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

PoC Detected

May 02, 2026 - 21:16 vuln.today

Public exploit code

Analysis Generated

May 02, 2026 - 21:00 vuln.today

EUVD ID Assigned

May 02, 2026 - 20:30 euvd

EUVD-2026-26801

Analysis Generated

May 02, 2026 - 20:30 vuln.today

CVE Published

May 02, 2026 - 20:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-bounds read. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Out-of-bounds read in MikroTik RouterOS 6.49.8 SCEP endpoint allows remote unauthenticated attackers to trigger memory disclosure and potential service disruption via malformed transactionID or messageType parameters. Public exploit code exists on GitHub. CVSS 7.3 reflects network-accessible attack surface with low complexity, though impact is rated limited across confidentiality, integrity, and availability. Vendor non-responsive to coordinated disclosure attempts.

Technical ContextAI

This vulnerability resides in the SCEP (Simple Certificate Enrollment Protocol) implementation within MikroTik RouterOS, specifically in the ASN1_STRING_data function of nova/lib/www/scep.p library. SCEP is used for automated certificate provisioning and management. The flaw is classified as CWE-125 (Out-of-bounds Read), occurring when the SCEP endpoint processes ASN.1 encoded certificate enrollment messages without proper bounds validation on transactionID or messageType fields. ASN.1 parsing vulnerabilities are common in cryptographic protocol implementations where variable-length encoded data structures can trigger memory access violations if length fields are not sanitized before dereferencing pointers. The affected CPE indicates MikroTik RouterOS as the vulnerable product family, with version 6.49.8 explicitly confirmed.

RemediationAI

No vendor-released patch identified at time of analysis despite early coordinated disclosure attempts. Immediate mitigation: disable SCEP endpoint access via firewall rules (IP > Firewall > Filter Rules) to block external access to TCP port 80/443 SCEP paths, typically /scep or /.well-known/est. For organizations requiring SCEP functionality, restrict access to trusted certificate authority IP ranges only. Trade-off: disabling SCEP breaks automated certificate enrollment workflows, requiring manual certificate installation. Consider upgrading to RouterOS 7.x stable branch if compatible with hardware, as the vulnerability description specifies 6.49.8, though migration requires testing for configuration compatibility. Monitor MikroTik security advisories at https://mikrotik.com/support/security for future patches. Implement network segmentation to prevent router management interfaces from direct internet exposure. Temporary workaround effectiveness depends on whether SCEP is operationally required; if not, disabling the service eliminates attack vector entirely.