MikroTik RouterOS CVE-2026-67277 exploited in the wild
Executive summary
CISA lists CVE-2026-67277, a vulnerability in MikroTik RouterOS, in the Known Exploited Vulnerabilities catalog (added 2026-09-10, due 2026-09-13), and NVD records a CVSS of 8.8. This report summarizes public CTI only.
Technical analysis
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) CPE: CWE-306. CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
IOCs
No public IOC is available.
CVEs and affected products
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
ATT&CK mapping
Exploit Public-Facing Application
Tactic: Initial Access
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.9
⚠️ This report describes public CTI and does not assess any specific organization's exposure.
⚠️ Detection queries are templates and require local validation.
⚠️ Exploitation status reflects the public CISA KEV catalog record.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
12 references
▼
Evidence consists of the NVD record, the CISA KEV catalog entry, the FIRST EPSS model output, and indexed source documents that reference this CVE.
NVD entry for CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) The record carries CVSS 8.8 (4.0) vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, weaknesses CWE-306.
CISA added CVE-2026-67277 to the Known Exploited Vulnerabilities catalog on 2026-09-10 with a required due date of 2026-09-13, recording the vulnerability as exploited in the wild and affecting vendor MikroTik, product RouterOS. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
FIRST EPSS models an exploitation probability of 0.0156 (percentile 0.74144) for CVE-2026-67277.
Source cisa-cybersecurity-advisories published 2026-09-10 at https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog references CVE-2026-67277 affecting MikroTik RouterOS.
Source cisa-known-exploited-vulnerabilities published 2026-09-10 at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json#CVE-2026-67277 references CVE-2026-67277 affecting MikroTik RouterOS.
Source nist-national-vulnerability-database-nvd published 2026-09-05 at https://nvd.nist.gov/vuln/detail/CVE-2026-67277 references CVE-2026-67277 affecting MikroTik RouterOS.
Source canadian-centre-for-cyber-security-alerts published undated at https://cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060 references CVE-2026-67277 affecting MikroTik RouterOS.
Source canadian-centre-for-cyber-security-alerts published undated at https://cyber.gc.ca/en/alerts-advisories/mikrotik-security-advisory-av26-887 references CVE-2026-67277 affecting MikroTik RouterOS.