MikroTik vulnerabilities in CISA KEV
MikroTik has 5 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 49th highest of any vendor. 3 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 3 days (range 3 to 182), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is RouterOS, with 5 entries.
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor mikrotik --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
5
in CISA KEV
┌─ first added
2021-12-01
earliest entry
┌─ latest added
2026-09-25
most recent entry
┌─ last 12 months
3
entries added
┌─ ransomware use
0 of 5
0% linked to ransomware
┌─ distinct products
1
affected products
$ awk -F, {print $1} /var/log/kev/mikrotik.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 1 | 0 |
| 2022 | 1 | 0 |
| 2026 | 3 | 0 |
$ sort /var/log/kev/mikrotik.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- RouterOS 5 entries
$ kev-due-dates --vendor mikrotik
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ MikroTik
3 days (range 3 to 182)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/mikrotik.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (5 of 5 have at least one CWE).
$ grep -ril 'MikroTik' /var/log/news | head -5
Our reporting that names MikroTik or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./mikrotik.kev · 5 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-67279
RouterOS
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
due 2026-09-28 · CWE-841
$ cat CVE-2026-67279.txt
Description. Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-67277
RouterOS
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
due 2026-09-13 · CWE-306
$ cat CVE-2026-67277.txt
Description. MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-86060
RouterOS
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
due 2026-09-13 · CWE-88
$ cat CVE-2026-86060.txt
Description. MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2018-7445
RouterOS
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
due 2022-09-29 · CWE-119
$ cat CVE-2018-7445.txt
Description. In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.
Required action. Apply updates per vendor instructions.
- CVE-2018-14847
RouterOS
MikroTik Router OS Directory Traversal Vulnerability
due 2022-06-01 · CWE-22
$ cat CVE-2018-14847.txt
Description. MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
Required action. Apply updates per vendor instructions.