~/f4n6 $ grep -r "CVE-2026-67277 MikroTik RouterOS: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability" ./investigations/ --include="*.md"

CVE-2026-67277 MikroTik RouterOS: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

Jeff Davies 10 Sep 2026 6 min read

1. Executive summary

CVE-2026-67277 is a missing authentication for critical function vulnerability (CWE-306) in MikroTik RouterOS affecting the bandwidth-test (btest) service, rated CVSS 8.8 HIGH and not currently listed in CISA's Known Exploited Vulnerabilities catalogue (EPSS 0%). An unauthenticated remote attacker can abuse the btest protocol to trigger kernel memory disclosure and cause a denial-of-service condition, including a kernel restart via packet-size handling errors. Fixes are available in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). EMEA financial services clients running MikroTik edge devices with btest reachable from untrusted networks should treat this as a priority patch-and-restrict item, particularly given that other flaws in the same September 2026 RouterOS disclosure wave are being actively exploited in the wild.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements The flaw causes kernel-level memory disclosure and device-kernel restarts on network equipment that financial entities must include in resilience testing scope; a denial-of-service on an edge router is an availability risk to ICT-dependent functions. Ensure MikroTik RouterOS versions and exposed services (btest, API, SSH, Winbox) are in scope for vulnerability scanning and resilience testing; verify patched versions 6.49.21 / 7.23.4 / 7.24.2 are enforced as a tested control.
DORA Art. 28: ICT third-party risk — general principles Where MikroTik devices are supplied, managed or hosted by ICT third-party providers (e.g., managed network or branch-connectivity providers), the vulnerability and its patch status must be addressed through third-party risk management. Obtain written confirmation from managed-service providers that affected RouterOS versions are patched or btest is disabled; reflect MikroTik patch status in third-party risk assessments.

No NIS2 or UK NIS article is specifically engaged beyond generic patching duties; the item does not describe an incident at a specific entity.

3. Technical analysis & attack chain

Vulnerability mechanism (corroborated by NVD, GitHub Security Advisory GHSA-6q2x-6fhj-r3w8, and BSI WID-SEC-2026-3193)

  1. The RouterOS btest (bandwidth test) service accepts a "related" btest connection before the corresponding primary session has completed authentication.
  2. An unauthenticated client exploits this pre-authentication state to start an IPv4 UDP bandwidth test.
  3. With the test configured as random-data=false, the sender transmits an uninitialized tail from a kernel packet buffer — i.e., kernel memory disclosure to the remote peer.
  4. Independently, an unchecked, inverted packet-size interval causes an unsigned integer underflow, producing anomalously large fragmented output and potentially restarting the RouterOS kernel — denial of service.

Key technical specifics

  • Component: btest service (RouterOS bandwidth test, /tool btest client and the router-side btest server, TCP/UDP).
  • Impact: kernel memory disclosure (confidentiality) + kernel restart/DoS (availability). No authentication required.
  • Fixed versions: 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable) — per GitHub Security Advisory GHSA-6q2x-6fhj-r3w8.
  • CWE: CWE-306, Missing Authentication for Critical Function (per NVD). Note: the source material describes the flaw in terms of a pre-authentication session-state flaw and an integer underflow; both descriptions characterise the same btest defect.
  • Exploitation status: Not in CISA KEV; EPSS 0% at time of writing. BSI rates the overall RouterOS advisory set as critical; CISA ICS advisory ICSA-26-209-05 states no known public exploitation of the related API brute-force flaw has been reported to CISA.

Context — the wider September 2026 RouterOS disclosure wave (single-sourced to CERT Polska via Malwarebytes Labs; verify before enforcement)

The same disclosure cycle includes CVE-2026-67276 (SSH RSA public-key authentication bypass) and CVE-2026-86060 (SSH username-handling privilege escalation changing the trusted RouterOS policy mask), which CERT Polska reports are being actively chained ("MikroTrick") to take full control of internet-exposed routers. CVE-2026-86060 is listed in CISA KEV with a due date of 2026-09-13. A compromised edge router enables DNS tampering, traffic interception, remote-access tunnels, firewall-rule changes and use as a foothold. CVE-2026-67277 is not part of the reported MikroTrick chain, but devices vulnerable to it are plausibly running versions vulnerable to the actively exploited flaws — treat exposure holistically. MikroTik has added a startup configuration scanner that detects selected unauthorised changes, disables them, and sets the device's Flagged status; check with /system/device-mode/print.

4. Mitigation & containment

P1 — within 24 hours

  1. Inventory and exposure check: Identify all MikroTik RouterOS and Cloud Hosted Router instances (including those operated by third parties/managed service providers). Determine whether the btest service is enabled and reachable from untrusted networks.
  2. Patch: Upgrade to RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) via the router's update mechanism ("Check for updates") or supported packages from MikroTik. Where immediate patching is not possible, apply vendor mitigations per CISA guidance or discontinue exposure of the affected service.
  3. Restrict management and test services: Apply firewall rules to block btest, SSH, API, Winbox and other management services from untrusted networks. Remote management should be the exception; where required, restrict to known IP addresses or require a strong VPN. CISA ICS guidance for the related flaws: minimise network exposure, locate devices behind firewalls, isolate from business networks.
  4. Check for compromise: On internet-exposed devices, run /system/device-mode/print and review the Flagged status; audit the full configuration (users, SSH keys, firewall rules, DNS settings, tunnels) before clearing any flag.

P2 — within 72 hours

  1. Harden authentication: Use long, randomly generated passwords; keep or replace the default randomly generated device password with an equally strong one (minimum complexity is not enforced by default). Restrict/limit access to management services from untrusted networks.
  2. API exposure: Where the RouterOS API is exposed, adopt a strong VPN or additional protection layer (per CISA ICSA-26-209-05); once available, configure the unsuccessful-attempt time range (0.1–0.5 seconds) in /ip service for all services including the API.
  3. Session hygiene (related flaw, CISA ICSA-26-211-01): Ensure users are fully logged out when permissions are downgraded so new policies take effect.

P3 — within 7 days

  1. Version pinning and monitoring: Enforce patched RouterOS versions as a configuration baseline; add MikroTik firmware versions to asset-management and vulnerability-scanning scope.
  2. Third-party confirmation: Where MikroTik devices sit with ICT third-party providers, obtain confirmation of patch status and exposure controls (feeds DORA Art. 28 third-party risk management).

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators (from the source material; these relate to the broader MikroTrick exploitation context and MikroTik's own detection mechanism, not specifically to CVE-2026-67277):

Behaviour Where to observe Confidence
Device Flagged status set to Yes by MikroTik's startup configuration scanner, with recognised suspicious entries disabled /system/device-mode/print on the router High (vendor-documented)
Unauthorised configuration changes: DNS settings, firewall rule alterations, remote-access tunnels, new SSH keys/users RouterOS configuration audit; configuration change logs Medium (single-sourced to CERT Polska reporting)
Unexplained RouterOS kernel restarts / anomalous large fragmented UDP output from btest Router logs; netflow/IDS on perimeter for high-volume UDP from router btest ports Medium (mechanism documented in GHSA; no observed-exploitation reports)

6. Detection

Insufficient indicators to author detection rules.

The source material provides no file artefacts, command-line strings, mutexes, registry keys or distinctive network signatures attributable to exploitation of CVE-2026-67277. The behavioural indicators in §5 (device Flagged status, configuration audit) are operational checks on the router itself rather than threat artefacts suitable for YARA/Sigma rules. Monitor for anomalous btest/UDP traffic volume from MikroTik devices and unexpected device reboots via existing network telemetry.

CVE assessment

1 referenced CVE

CVE CVSS Exploited EPSS Summary
CVE-2026-67277 8.8 High — 0% RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthe…

7. Sources

  • NVD — CVE-2026-67277 — MikroTik RouterOS: Missing Authentication for Critical Function Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-67277 — 2026-09-09
  • GitHub Security Advisories — GHSA-6q2x-6fhj-r3w8 — RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication — https://github.com/advisories/GHSA-6q2x-6fhj-r3w8 — accessed 2026-09-10
  • BSI (Germany) — WID-SEC-2026-3193 — [NEU] [kritisch] MikroTik RouterOS: Mehrere Schwachstellen — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3193 — accessed 2026-09-10
  • CISA ICS Advisories — ICSA-26-209-05 — MikroTik RouterOS and Cloud Hosted Router: Improper Restriction of Excessive Authentication Attempts — https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05 — accessed 2026-09-10
  • CISA ICS Advisories — ICSA-26-211-01 — MikroTik RouterOS: Insufficient Session Expiration — https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01 — 2026-07-30
  • Malwarebytes Labs — MikroTik router flaws allow takeover without a password (reporting CERT Polska "MikroTrick" warning) — https://www.malwarebytes.com/blog/news/2026/09/mikrotik-routers-can-be-taken-over-without-password — accessed 2026-09-10
  • NVD — CVE-2026-86060 — MikroTik RouterOS: Improper Neutralization of Argument Delimiters in a Command Vulnerability (CISA KEV context) — https://nvd.nist.gov/vuln/detail/CVE-2026-86060 — accessed 2026-09-10

8. Adverse Trace position

CVE-2026-67277 is a genuine high-severity (CVSS 8.8) unauthenticated flaw in MikroTik RouterOS's btest service, enabling kernel memory disclosure and device-level denial of service; it is not in CISA KEV and carries EPSS 0%, so we assess exploitation probability as currently low — but the impact ceiling on an edge device (kernel memory leakage, forced restarts on routing infrastructure) justifies urgent patching wherever btest is reachable from untrusted networks. The surrounding disclosure wave changes the risk calculus: CERT Polska (single-sourced via Malwarebytes Labs — verify before enforcement) reports active in-the-wild chaining of sibling CVEs (CVE-2026-67276, CVE-2026-86060) into full device takeover, and any device vulnerable to CVE-2026-67277 is likely running a version vulnerable to those actively exploited flaws. Clients should patch to 6.49.21 / 7.23.4 / 7.24.2, remove all management and test services from internet exposure, and audit flagged devices. Adverse Trace will monitor for KEV listing, EPSS movement, and any observed exploitation of the btest flaw, and will update this advisory if the MikroTrick chain is confirmed to incorporate CVE-2026-67277 or if IOCs emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies