{"type":"bundle","id":"bundle--6246affb-430c-567c-af93-51ad1ba6b8ca","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--e3df9f96-6b99-567b-98f0-b71caea052e7","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:06.055280Z","modified":"2026-09-24T19:51:06.055280Z","name":"CVE-2026-67277","description":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)","external_references":[{"source_name":"cve","external_id":"CVE-2026-67277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67277"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:06.055280Z","modified":"2026-09-24T19:51:06.055280Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d4027619-4316-5169-a501-b9535f9d8aca","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:06.055280Z","modified":"2026-09-24T19:51:06.055280Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--e3df9f96-6b99-567b-98f0-b71caea052e7"},{"type":"report","spec_version":"2.1","id":"report--31a47163-e31e-5692-8a86-0e13ff43649b","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:06.055280Z","modified":"2026-10-30T15:09:21.379133Z","name":"MikroTik RouterOS CVE-2026-67277 exploited in the wild","description":"CISA lists CVE-2026-67277, a vulnerability in MikroTik RouterOS, in the Known Exploited Vulnerabilities catalog (added 2026-09-10, due 2026-09-13), and NVD records a CVSS of 8.8. This report summarizes public CTI only.","published":"2026-09-24T19:51:06.055280Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--e3df9f96-6b99-567b-98f0-b71caea052e7","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","relationship--d4027619-4316-5169-a501-b9535f9d8aca"],"confidence":90}]}