Skip to content
OpenAdvisories
Critical 4 exploited CVEs WID-SEC-2026-3193 6 CVEs

MikroTik RouterOS: Mehrere Schwachstellen

Published Sep 6, 2026 · Updated Sep 10, 2026 · Revision 2 · de-DE

Vendor: MikroTik Product: RouterOS

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MikroTik RouterOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um einen Denial of Service Zustand herbeizuführen und um die Kontrolle über betroffene Geräte zu übernehmen.

Product

MikroTik RouterOS ist ein auf Linux basierendes Betriebssystem, das für MikroTik RouterBOARD Hardware und PC-Installationen entwickelt wurde und umfangreiche Routing-, Firewall- und Netzwerkverwaltungsfunktionen bietet.

Vulnerabilities 6

  • Critical 9.2
    CVE-2026-67276 Exploited Public exploit

    SSH user impersonation possible in Mikrotik RouterOS

    RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker …

    MikroTik RouterOS Network devices
  • Critical 9.2
    CVE-2026-86060 Exploited Public exploit

    SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

    RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticate…

    MikroTik RouterOS Network devices
    KEV Sep 10, 2026
  • High 8.8
    CVE-2026-67277 Exploited

    Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

    RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail f…

    MikroTik RouterOS Network devices
    KEV Sep 10, 2026
  • Medium 6.9
    CVE-2026-67279 Exploited Public exploit

    SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

    RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the…

    MikroTik RouterOS Network devices
    KEV Sep 25, 2026
  • High 8.7
    CVE-2026-67281 Public exploit

    Unauthenticated file read in Mikrotik RouterOS

    RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that…

    MikroTik RouterOS Network devices
  • Medium 6.3
    CVE-2026-67278

    TLS server impersonation possible in Mikrotik RouterOS

    MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an ou…

    MikroTik RouterOS Network devices

Revision history

  1. #2

    Vulname added

  2. #1

    Initiale Fassung

References