CVE-2026-67281 Unauthenticated file read in Mikrotik RouterOS

High 8.7 Published 5 Sep 2026 Updated 8 Sep 2026

Unauthenticated attackers can read root-owned files, including credentials, via path traversal in the WebFig jsproxy interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-67281?

CVE-2026-67281 is a high-severity path traversal vulnerability in Mikrotik Routeros, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

Weakness: CWE-824, CWE-22

Which versions are affected by CVE-2026-67281?

It affects 1 product.

Products include Mikrotik Routeros.

How do I fix CVE-2026-67281?

No fix has been published for CVE-2026-67281 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-67281 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67281 exists.

Public exploit code: 1 proofs of concept on GitHub.

All Mikrotik Routeros vulnerabilities

Sources

Also known as GHSA-m7q3-cwh2-ffg5.