CVE-2026-67277 Mikrotik RouterOS
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail…
- CVSS
- 8.8 High
- EPSS
- 1.6%
- Percentile
- 76
- Published
- 2026-09-05
- Force
- 9 of 12
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- Added
- 2026-09-10
- Federal patch deadline
- 2026-09-13
- Ransomware use
- not known