MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
MikroTik RouterOS btest service missing authentication allows kernel memory disclosure. CVSS 8.2 (high), CISA KEV deadline September 13, 2026.
- Vendor
- MikroTik
- Product
- RouterOS
- CVSS
- 8.2
- EPSS (exploit probability)
- 1.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-67277 being exploited?
Yes. CISA added CVE-2026-67277 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.6% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-67277 timeline
- Added to EU KEV (ENISA)same day as NVD
- Published to NVD
- Added to CISA KEV+5d
- First 0dayNews coverage+8d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An unauthenticated client can reach the RouterOS btest (bandwidth test) service without authenticating. The missing authentication check allows the attacker to trigger kernel memory disclosure from the service. Under certain packet-size conditions, the same flaw causes unsigned integer underflow and anomalously large fragmented output, which can restart the RouterOS kernel.
CISA added CVE-2026-67277 to its Known Exploited Vulnerabilities catalog on September 10, 2026. Federal agencies must remediate by September 13, 2026. Per the NVD entry, fixes are in RouterOS 6.49.21, 7.23.4 (Long-term), and 7.24.2 (Stable). Update to your channel’s current fixed version.
Other MikroTik RouterOS CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerabilitywrite-up | [ MEDIUM ] | 6.5 | 2.3% | |
| CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 6.4% | |
| CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 65.8% | |
| CVE-2018-14847 MikroTik Router OS Directory Traversal Vulnerability | [ CRITICAL ] | 9.1 | 96.0% |
