CVE-2026-67281

Unauthenticated file read in Mikrotik RouterOS

No known exploitation. EPSS puts it in the 54th percentile. Fixed versions are out.

CVSS 3.17.5High EPSS percentile54th0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1 product2 fixed builds listed below

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.119494

Run the check

Published 2026-09-05Updated 2026-09-25Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Mikrotik RouterOSAffected: ≥ 7.24, < 7.24.2Upgrade to: 7.24.2Affected: ≥ 7.20, < 7.23.4Upgrade to: 7.23.4Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which RouterOS version your router is running (System > Resources or /system resource print).
If you are on any 7.x version below 7.23.4 (Long-term) or 7.24.2 (Stable), you are affected.
Upgrade to RouterOS 7.24.2 (Stable branch) or 7.23.4 (Long-term branch), whichever matches your current branch.
If you can't upgrade immediately, disable WebFig access from the internet (restrict it to trusted local networks only) using firewall rules.
After upgrading, change router admin passwords and any credentials that may have been stored in configuration files, in case they were already exposed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

In plain language

Written by AI from the record

This is a serious flaw in Mikrotik RouterOS that lets an attacker steal your router's passwords and configuration files without logging in, and there are signs it's already being used against routers in the wild — you should act now.

Unauthenticated path-traversal/file-read in RouterOS WebFig (/jsproxy) caused by a stale uninitialized session pointer used for authorization, allowing remote disclosure of root-owned files including credential stores; fixed in 7.23.4 (LTS) and 7.24.2 (Stable).

If you're affected

Router credential theft
Network takeover risk
Exposure of internal configs
Follow-on attacks using stolen creds
Operational disruption from compromised router

What is it

Think of your router's web management page as a filing cabinet with a lock. This bug lets a stranger reach past the lock and pull out files from the cabinet — including the ones with your network's passwords — without ever needing a key. Once they have those passwords, they can potentially take over your router and anything behind it.

Who is affected

This matters to you if you run a Mikrotik router on RouterOS version 7.x and its web management interface (WebFig) is reachable from the internet or an untrusted network. No login is required for an attacker to exploit it, so exposure depends entirely on whether that management page is accessible from outside your trusted network.

How urgent is it

Reports indicate this flaw is already being actively exploited against RouterOS devices, so this is not a theoretical risk — it's happening now. Because no login is needed and the attack can be carried out remotely, any exposed router is a live target. Treat this as urgent: restrict access and patch without delay.

What to do — in detail

Confirm exposure by checking whether WebFig (typically served over HTTP/HTTPS on the router's management IP) is reachable from the internet or any untrusted segment; also check RouterOS version via /system resource print or Winbox. Affected versions are the 7.x branch prior to the fixes. Target 7.23.4 for devices on the Long-term branch and 7.24.2 for devices on the Stable branch — upgrade within the same branch to avoid unexpected feature changes. If immediate patching isn't possible, apply the workaround from Mikrotik/CERT.PL guidance: firewall off WebFig/API/Winbox access from WAN and restrict management access to a trusted VLAN or VPN only. This CVE is not currently listed in CISA KEV, so there is no federal remediation deadline, but active-exploitation reports warrant treating it with KEV-level urgency. After patching, rotate credentials stored on the device (admin passwords, VPN PSKs, RADIUS secrets) since they may have been exposed via the file-read. Monitor for unusual /jsproxy requests, unexpected configuration exports, or new admin accounts in logs.

Technical context

CVSS 3.1 7.5 (High), AV:N/AC:L/PR:N/UI:N — remote, low complexity, no privileges or user interaction, confidentiality impact only (no integrity/availability). Weakness is path traversal (CWE-22) compounded by an uninitialized/stale pointer access issue (CWE-824) in the authorization check for the /jsproxy file-serving path. No public exploit code or PoC is confirmed on record and EPSS scoring reflects low predicted mass-exploitation probability, but press/pulse reporting (cert.pl roundup, actor reference 'DataSuckers') indicates active exploitation in the wild, which should be weighted above the EPSS prediction. Not currently in CISA KEV. Fixed in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS54th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 54th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 20 days, from the signal feeds we watch.

2026-09-25Patch availableworkaround available, record updated
2026-09-08Record updatedrecord updated
2026-09-07Record updated
2026-09-05OpenVAS check addedpublished, weakness classified, att&ck mapped, record updated

Affected products

Mikrotikcommercial · LVaka routeros, winbox
- RouterOSNetwork DeviceOn-premNetworking Infrastructure / router-switch

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

CollectionT1005Data from Local Systemmedium confidence
DiscoveryT1083File and Directory Discoveryhigh confidence
Privilege EscalationT1068Exploitation for Privilege Escalationmedium confidence

Sources

References in the record

And 3 more references. See all after sign-in

Analysis on the cve.tools blog

MikroTik's Newest Router Bugs Were Found by an AI Model. Its Last Two KEV Listings Fueled the Mēris Botnet.On September 2, 2026, someone started breaking into MikroTik routers over SSH using a bug that had no patch, no CVE, and no name. On September 3, MikroTik shipped one anyway — buried in a changelog…2026-09-21 · 6 min read

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for RouterOS, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account