Buffer Overflow Vulnerability in MikroTik RouterOS
CVE-2026-67277

8.8HIGH

Key Information:

Vendor

Mikrotik

Status
Routeros
Vendor
CVE Published:
5 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-67277?

MikroTik RouterOS exhibits a vulnerability that permits unauthenticated clients to initiate a specific type of btest connection before the primary session authentication is completed. This flaw arises from improper handling of kernel packet buffers, leading to the potential for an unsigned integer underflow which, coupled with anomalously large fragmented output, can inadvertently restart the RouterOS kernel. The issue is pertinent for versions 6.49.20 and earlier as well as 7.23.3 and earlier, necessitating urgent updates to mitigate the risks involved.

Affected Version(s)

RouterOS 7.24 < 7.24.2

RouterOS 7.0.0 < 7.23.4

RouterOS 6.0.0 < 6.49.21

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
third-party-advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikro...
technical-description
https://npratley.net/reversing-mikrotiks-silent-patch-the...
exploit

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sławomir Rozbicki (CERT.PL)
.