Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-67277 Details

Description

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277	CISA-ADP	US Government Resource
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve	[email protected]	Third Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/	[email protected]	MitigationThird Party Advisory
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802	[email protected]	Release Notes
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801	[email protected]	Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800	[email protected]	Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/	[email protected]	Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/	[email protected]	ExploitThird Party Advisory

see all 8 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability	Sep 10, 2026	Sep 13, 2026	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-306	Missing Authentication for Critical Function	[email protected]

Affected Products

Product	Versions
mikrotik routeros	>= 6.0, < 6.49.21 >= 7.0, < 7.23.4 >= 7.24, < 7.24.2
CPE cpe:2.3:o:mikrotik:routeros:::::::: Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Sep 11, 2026	Initial Analysis	[email protected]
Sep 11, 2026	CVE Modified	CISA-ADP
Sep 10, 2026	CVE CISA KEV Update	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Sep 10, 2026	CVE Modified	CISA-ADP
Sep 9, 2026	CVE Modified	CISA-ADP
Sep 8, 2026	CVE Modified	CISA-ADP
Sep 5, 2026	CVE Modified	[email protected]
Sep 5, 2026	New CVE Received	[email protected]