[ Vendor · 15 CVEs ]
MikroTik
CVEs affecting MikroTik published in the last 30 days, plus any MikroTik CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-89035 | 21 Oct 2026 | CVSS 7.4 | MikroTik RouterOSMikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication… | |
| CVE-2026-112158 | 19 Oct 2026 | CVSS 6.5 | MikroTik RouterOSA weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing… | |
| CVE-2026-103903 | 12 Oct 2026 | CVSS 8.8 | MikroTik RouterOSAn incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with… | |
| CVE-2026-84411 | 2 Oct 2026 | CVSS 9.8 | MikroTik RouterOSThe web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before… | |
| CVE-2026-67277 | 5 Sep 2026 | CVSS 8.2 | MikroTik RouterOS Missing Authentication for Critical FunctionRouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can… | Exploited |
| CVE-2026-67277 | 5 Sep 2026 | CVSS 8.2 | MikroTik RouterOS Missing Authentication for Critical FunctionRouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can… | Exploited |
| CVE-2026-67279 | 5 Sep 2026 | CVSS 6.5 | Mikrotik RouterOS Improper Enforcement of Behavioral WorkflowRouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an… | Exploited |
| CVE-2026-67279 | 5 Sep 2026 | CVSS 6.5 | Mikrotik RouterOS Improper Enforcement of Behavioral WorkflowRouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an… | Exploited |
| CVE-2026-86060 | 5 Sep 2026 | CVSS 9.8 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a CommandRouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the… | Exploited |
| CVE-2026-86060 | 5 Sep 2026 | CVSS 9.8 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a CommandRouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the… | Exploited |
| CVE-2025-42611 | 5 May 2026 | CVSS 6.5 | Mikrotik RouterOSRouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of… | |
| CVE-2018-14847 | 2 Aug 2018 | CVSS 9.1 | MikroTik Router OS Directory TraversalMikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary… | Exploited |
| CVE-2018-14847 | 2 Aug 2018 | CVSS 9.1 | MikroTik Router OS Directory TraversalMikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary… | Exploited |
| CVE-2018-7445 | 19 Mar 2018 | CVSS 9.8 | MikroTik RouterOS Stack-Based Buffer OverflowA buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to… | Exploited |
| CVE-2018-7445 | 19 Mar 2018 | CVSS 9.8 | MikroTik RouterOS Stack-Based Buffer OverflowA buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to… | Exploited |