Authorization Flaw in MikroTik RouterOS WinBox Allows Privilege Escalation

CVE-2026-103903

What is CVE-2026-103903?

An incorrect authorization vulnerability has been discovered in the MikroTik RouterOS WinBox authentication process. This flaw enables a remote authenticated attacker with low-privilege credentials to exploit the authentication flow and gain unauthorized access. By manipulating the WinBox protocol, the attacker can use their own low-level account to impersonate a higher-privileged account, such as an admin. This allows them to obtain full administrative rights and elevate their account privileges without needing the target account's password, posing a significant security risk.

References