CVE-2026-67277highunder attackCWE-306

Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 0.4%

from disclosure to weapon

Published on NVDSep 5

CISA KEV+5d

exploitation probability

0.4%top 63% of all CVEs

observed exploitation

yesCISA + VulnCheck

1 public exploit(s)

In short

RouterOS allows unauthenticated users to connect to a testing service without proper authentication, leaking sensitive data from the system's memory and potentially crashing the router. This happens because the router accepts connections before verifying the user's identity.

Technical detail

CVE-2026-67277 exploits improper access control (CWE-306) in RouterOS btest service, allowing unauthenticated clients to initiate UDP test sessions and trigger kernel memory disclosure via uninitialized buffer transmission. An integer underflow in packet-size handling causes excessive fragmentation and kernel crash; requires network access but no prior authentication.

Summary generated and translated by AI from the official description.

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

Mikrotik · RouterOS

public PoCs found — 1

cve_referencenpratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 https://mikrotik.com/supportsec/september-2026-vulnerability/https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277