Target Audience:
All end-user organizations and individuals using MikroTik Routers.
Risk Assessment:
High risk of authentication bypass, remote code execution, privilege escalation, sensitive in-formation disclosure, denial-of-service.
Impact Assessment:
Potential for complete system compromise.
Software Affected
- MikroTik RouterOS 6 versions prior to 6.49.21
- MikroTik RouterOS 7.23.x versions prior to 7.23.6
- MikroTik RouterOS 7.24.x versions prior to 7.24.3
Description
MikroTik RouterOS is a network operating system used in various networking devices.
Multiple vulnerabilities exist in MikroTik Routers due to improper authentication, improper en-forcement of security checks, argument injection, and memory handling issues. An attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system, such as through the SSH service, the WebFig interface, or the bandwidth-test service.
Successful exploitation of these vulnerabilities could allow a remote attacker to bypass au-thentication, gain elevated privileges, execute arbitrary code, obtain sensitive information, or cause denial of service on the targeted system.
Note: These vulnerabilities along with the SSH vulnerabilities CVE-2026-67279 and CVE-2026-86060 in combination, under the name "MikroTrick" are being actively exploited in the wild.
Solution
Apply appropriate updates as mentioned by the vendor:
https://mikrotik.com/supportsec/september-2026-vulnerability/
Vendor Information
MikroTik Routers
https://mikrotik.com/supportsec