CVE-2026-67277
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- Published Sep 5, 2026
- CVSS 8.8 high
- 1.6% chance of exploitation in the next 30 days (EPSS)
- In CISA's Known Exploited Vulnerabilities catalog
- Public exploit code is available
- A fix is available
Affected software
In the news
- Multiple Vulnerabilities in Mikrotik Routers Could Allow for Admin Hijacking CIS MS-ISAC ·
- Mikrotik security advisory (AV26-887) – Update 2 Canadian Centre for Cyber Security ·