CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function
Unauthenticated attackers can leak kernel memory and crash the RouterOS kernel via the btest service.
- Exploited in the wild
- Since 10 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67277?
CVE-2026-67277 is a high-severity vulnerability in Mikrotik Routeros, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.
This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Weakness: CWE-306
Which versions are affected by CVE-2026-67277?
It affects 1 product.
Products include Mikrotik Routeros.
How do I fix CVE-2026-67277?
No fix has been published for CVE-2026-67277 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 13 Sep 2026.
Is CVE-2026-67277 being exploited?
Yes. Attackers have exploited CVE-2026-67277 in the wild since at least 10 Sep 2026.
Other vulnerabilities in Mikrotik Routeros
- CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow
- CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command
- CVE-2018-14847 MikroTik Router OS Directory Traversal
- CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow
- CVE-2017-20149 Memory corruption in n/a
Sources
Also known as GHSA-6q2x-6fhj-r3w8.