Three RouterOS vulnerabilities are already used in attacks. Which RouterOS versions are safe and how to lock down management access.
MikroTik routers are everywhere in small and medium offices — and attackers know it. Since September 2026 MikroTik has published a series of serious vulnerabilities, and the U.S. agency CISA has added three of them to its Known Exploited Vulnerabilities catalog, which means they are being used in real attacks.
| CVE | Problem | Fixed in |
|---|---|---|
CVE-2026-67279 ⚠️ | SSH: command execution without authentication — exploited | 7.24.2, 7.23.4, 6.49.21 |
CVE-2026-86060 ⚠️ | SSH: username handling gives excessive rights — exploited | 7.24.2, 7.23.4, 6.49.21 |
CVE-2026-67277 ⚠️ | Bandwidth test: crash or memory disclosure — exploited | 7.24.2, 7.23.4, 6.49.21 |
CVE-2026-67276 | SSH public key authentication bypass | 7.24.2, 7.23.4, 6.49.21 |
CVE-2026-67281 | WebFig: file read without authentication (v7.20+) | 7.24.2, 7.23.4 |
CVE-2026-67278 | Forged TLS certificates and SSH host keys (v7) | 7.24.3, 7.23.6 |
CVE-2026-84411 | WebFig: integer underflow, one HTTP request without login can crash the router or run code — critical | 7.24, 7.23.8, 6.49.23 |
CVE-2026-88464 | SNMP stack buffer overflow | 7.24, 7.23.3 |
CVE-2026-89021 | Container image import path traversal | 7.24.2 (no long-term fix) |
CVE-2026-98432 | Linux kernel IPv4 TCP bug — instability or reboot | 7.25.1, 7.24.6 |
/ip service disable telnet,ftp,www,api,api-ssl, bandwidth test server, SNMP (or restrict it to your monitoring server).admin user and use strong unique passwords.A router exposed to the internet with management open is an invitation. Close it first, then update.
CySec is a MikroTik integrator: we update and audit RouterOS devices, harden management access and build secure VPN and VLAN setups.
Sources: MikroTik security advisories, CISA KEV catalog.
In Winbox the version is shown in the title bar; in the terminal run /system resource print. Compare it with the fixed versions in the table above.
The risk is much lower, but devices inside your network — or an infected computer — can still reach them. Update anyway.
Look for unknown users (/user print), scheduler scripts (/system scheduler print), unexpected files, enabled proxy or SOCKS, and firewall or NAT rules you did not create.
Yes — CySec audits, updates and hardens RouterOS devices, including routers that may already be compromised.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.