6
CVEs
2
Critical
2
High
2
KEV
6
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
2
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86060 | Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data. | CRITICAL | 9.2 | 0.4% | 116 |
KEV
PoC
|
| CVE-2026-67277 | Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: kernel memory disclosure and kernel crash/restart. The btest server accepts a 'related' secondary UDP connection before the primary TCP control session completes authentication, permitting a pre-auth attacker to drive the btest data path. With random-data=false, the kernel transmits uninitialized packet buffer contents to the attacker; a separate unchecked inverted packet-size interval triggers unsigned integer underflow producing anomalously large fragmented output that crashes the RouterOS kernel. CERT-PL reported this vulnerability and a CERT-PL advisory titled 'actively exploited' indicates in-the-wild use, though CISA KEV confirmation is absent from available data; a public exploit and binary reverse-engineering write-up are available. | HIGH | 8.8 | 0.4% | 114 |
KEV
PoC
|
| CVE-2026-67276 | Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user by exploiting incomplete RSA public-key comparison. During public-key auth RouterOS matches only the key type and modulus and ignores the exponent, so an attacker who knows an authorized user's RSA modulus can submit a key with exponent 1, forge a signature the server will validate, and open a command channel without the private key. Publicly available exploit code exists (reverse-engineered from the silent patch), and CERT-PL - the reporting party - describes the RouterOS vulnerabilities as being actively exploited, though this CVE is not confirmed in CISA KEV from the provided data. | CRITICAL | 9.2 | 0.2% | 66 |
PoC
|
| CVE-2026-67281 | Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. Fixed versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) are available; a public exploit writeup exists, and CERT-PL's September 2026 reporting references active exploitation of this class of MikroTik vulnerabilities. | HIGH | 8.7 | 0.5% | 64 |
PoC
|
| CVE-2026-67279 | SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data. | MEDIUM | 6.9 | 0.4% | 55 |
PoC
|
| CVE-2026-67278 | TLS server impersonation in MikroTik RouterOS is enabled by improper RSA/PKCS#1 v1.5 signature verification that fails to reject malformed signatures produced via cube-root forgery against an e=3 root CA already present in the router's trust store. An attacker positioned to intercept outbound RouterOS TLS sessions can forge a trusted intermediate CA certificate - using only the root CA's public certificate, without its private key - and issue leaf certificates for arbitrary hostnames, fully impersonating TLS servers the router connects to. A publicly available exploit exists based on CERT-PL research and independent reverse-engineering of the 7.23.4 silent patch; vendor-released patches are available across all supported branches. | MEDIUM | 6.3 | 0.2% | 52 |
PoC
|