16
CVEs
2
Critical
7
High
2
KEV
9
PoC
5
Unpatched C/H
50.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
7
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86060 | Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data. | CRITICAL | 9.2 | 0.4% | 116 |
KEV
PoC
|
| CVE-2026-67277 | Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: kernel memory disclosure and kernel crash/restart. The btest server accepts a 'related' secondary UDP connection before the primary TCP control session completes authentication, permitting a pre-auth attacker to drive the btest data path. With random-data=false, the kernel transmits uninitialized packet buffer contents to the attacker; a separate unchecked inverted packet-size interval triggers unsigned integer underflow producing anomalously large fragmented output that crashes the RouterOS kernel. CERT-PL reported this vulnerability and a CERT-PL advisory titled 'actively exploited' indicates in-the-wild use, though CISA KEV confirmation is absent from available data; a public exploit and binary reverse-engineering write-up are available. | HIGH | 8.8 | 0.4% | 114 |
KEV
PoC
|
| CVE-2026-67276 | Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user by exploiting incomplete RSA public-key comparison. During public-key auth RouterOS matches only the key type and modulus and ignores the exponent, so an attacker who knows an authorized user's RSA modulus can submit a key with exponent 1, forge a signature the server will validate, and open a command channel without the private key. Publicly available exploit code exists (reverse-engineered from the silent patch), and CERT-PL - the reporting party - describes the RouterOS vulnerabilities as being actively exploited, though this CVE is not confirmed in CISA KEV from the provided data. | CRITICAL | 9.2 | 0.2% | 66 |
PoC
|
| CVE-2026-67281 | Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. Fixed versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) are available; a public exploit writeup exists, and CERT-PL's September 2026 reporting references active exploitation of this class of MikroTik vulnerabilities. | HIGH | 8.7 | 0.5% | 64 |
PoC
|
| CVE-2024-27686 | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.2% | 58 |
PoC
No patch
|
| CVE-2025-10948 | A vulnerability has been found in MikroTik RouterOS 7. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.4 | 0.2% | 57 |
PoC
No patch
|
| CVE-2026-67279 | SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data. | MEDIUM | 6.9 | 0.4% | 55 |
PoC
|
| CVE-2026-16347 | Brute-force vulnerability in MikroTik RouterOS allows adjacent network attackers to gain full administrative access by repeatedly guessing API credentials without effective lockout or rate-limiting. The absence of source-based restrictions and the ability to bypass a weak per-connection delay through concurrent sessions make high-volume password attacks practical. Successful exploitation grants complete control over the device, compromising confidentiality, integrity, and availability. | HIGH | 8.7 | 0.2% | 54 |
No patch
|
| CVE-2026-67278 | TLS server impersonation in MikroTik RouterOS is enabled by improper RSA/PKCS#1 v1.5 signature verification that fails to reject malformed signatures produced via cube-root forgery against an e=3 root CA already present in the router's trust store. An attacker positioned to intercept outbound RouterOS TLS sessions can forge a trusted intermediate CA certificate - using only the root CA's public certificate, without its private key - and issue leaf certificates for arbitrary hostnames, fully impersonating TLS servers the router connects to. A publicly available exploit exists based on CERT-PL research and independent reverse-engineering of the 7.23.4 silent patch; vendor-released patches are available across all supported branches. | MEDIUM | 6.3 | 0.2% | 52 |
PoC
|
| CVE-2026-7668 | Out-of-bounds read in MikroTik RouterOS 6.49.8 SCEP endpoint allows remote unauthenticated attackers to trigger memory disclosure and potential service disruption via malformed transactionID or messageType parameters. Public exploit code exists on GitHub. CVSS 7.3 reflects network-accessible attack surface with low complexity, though impact is rated limited across confidentiality, integrity, and availability. Vendor non-responsive to coordinated disclosure attempts. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-14227 | Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management. | MEDIUM | 6.9 | 0.2% | 45 |
No patch
|
| CVE-2026-48695 | OS command injection in FastNetMon Community Edition through 1.2.9 lets an authenticated network attacker execute arbitrary shell commands via the MikroTik router integration plugin by influencing argv[] values passed to the unsanitized _log() function. The flaw mirrors a previously disclosed Juniper plugin issue in the same project, and while a public technical write-up exists at lorikeetsecurity.com, no public exploit code or active exploitation has been identified, with EPSS at 0.05% (17th percentile). | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-39042 | Denial of service in MikroTik RouterOS 7.21.x (before 7.21.4) and 7.22.x (before 7.22.2) allows a remote unauthenticated attacker to crash the core inter-process communication layer by triggering an integer overflow in the unflatten() function of the bundled libumsg.so library. Successfully exploiting it disrupts device availability without touching data confidentiality or integrity. There is no public exploit identified at time of analysis, though a third-party research blog documents the underlying integer overflow; EPSS is low at 0.20% (10th percentile). | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-89021 | Path traversal in MikroTik RouterOS's container package OCI/tar image extraction enables an authenticated administrator to be induced into importing a crafted container image that writes arbitrary files outside the container root onto the device's persistent data partition with root privileges. The vulnerability fires entirely at import time via the `/container/add` endpoint - the container never needs to start - enabling file creation, deletion via overlayfs whiteout, directory creation, and hardlink creation on the host filesystem. No public exploit has been identified and SSVC rates exploitation as none, but the 7.23.x long-term branch remains unpatched indefinitely, with container-7.23.3.npk and container-7.23.4.npk confirmed byte-identical. | MEDIUM | 6.9 | 0.2% | 34 |
|
| CVE-2025-42611 | RouterOS fails to properly validate certificate scope across its shared system certificate store, allowing any trusted certificate authority to authenticate in contexts beyond its intended scope. This vulnerability enables partial or full authentication bypass in OpenVPN, CAPsMAN, and 802.1X (Dot1x) services, affecting all RouterOS versions that use the vulnerable shared certificate validation logic. The vulnerability requires network access but no user interaction or authentication, making it remotely exploitable against default configurations. | MEDIUM | 6.5 | 0.0% | 33 |
No patch
|