CVE-2026-14227: falha de média gravidade em MikroTik RouterOS
Insufficient session expiration in MikroTik RouterOS
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MikroTik · RouterOSCVEs relacionadas — MikroTik RouterOS
No mesmo produto, das mais perigosas para as menos.
CVE-2019-3943—CVE-2019-3943EPSS 3.7%CVE-2023-30800HIGHMikroTik RouterOS Web Interface Heap CorruptionEPSS 1.7%CVE-2023-30799CRITICALMikroTik RouterOS Administrator Privilege EscalationEPSS 1.4%CVE-2025-10948HIGHMikroTik RouterOS libjson.so print parse_json_element buffer overflowEPSS 1.0%CVE-2026-84411CRITICALMikroTik RouterOS Integer UnderflowEPSS 0.9%CVE-2025-6563MEDIUMCross-site scripting via dst parameter in RouterOS WiFi hotspotEPSS 0.7%