Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-67277

Published 2026-09-05

Updated last month

Vendor/s

MikroTik

Product/s

RouterOS

Version/s

6.0 > 6.49.21

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

8.2

/ 10

High

Severity Details

Base score

8.2 High

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-67277 is a high-severity MikroTik RouterOS vulnerability allowing unauthenticated remote kernel crashes and sensitive data disclosure.

## Why this matters

"CVE-2026-67277 is a significant threat because it is actively exploited in the wild and listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. With a CVSS score of 8.2, this vulnerability allows unauthenticated remote attackers to bypass authentication within the MikroTik Bandwidth Test (btest) service. Exploitation can lead to the leakage of sensitive kernel memory and trigger a kernel restart, resulting in a complete denial of service (DoS). Given that MikroTik devices often serve as critical network gateways, this unauthenticated exploit poses a severe risk to both network availability and data confidentiality."

## CPE

MikroTik

| Product  | Version Start | Version End (excl.) | Status     |
| -------- | ------------- | ------------------- | ---------- |
| routeros | 6.0           | 6.49.21             | vulnerable |
| routeros | 7.0           | 7.23.4              | vulnerable |
| routeros | 7.24          | 7.24.2              | vulnerable |

## Related weakness (CWE)

CWE-306

## Remediation plan

1

### Apply official patches

Download and install the latest security updates from MikroTik. The vendor has released specific patches to address the btest authentication bypass and integer underflow issues across their Long-term and Stable release channels.

2

### Update affected systems

Upgrade all MikroTik RouterOS instances to version 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) or later. Systems running versions between 6.0 and 6.49.20, 7.0 and 7.23.3, or 7.24 and 7.24.1 are confirmed vulnerable.

3

### Restrict access

Disable the Bandwidth Test (btest) server if it is not required for business operations. If the service must remain active, implement firewall rules to restrict access to UDP port 2000 to only trusted, authorized administrative IP addresses.

4

### Monitor for exploitation

Analyze network traffic for anomalous UDP patterns and large fragmented packets targeting the btest service. Regularly review RouterOS system logs for unexpected kernel reboots or 'btest' session errors originating from unauthenticated sources.

## Detection Guidance

"Security teams should monitor for unauthorized UDP traffic on port 2000, the default for the MikroTik Bandwidth Test protocol. Look for anomalous packet sizes or high volumes of fragmented UDP output, which may indicate an attempted integer underflow attack. Review device logs for frequent kernel restarts or unauthenticated btest session attempts. Network-based IDS signatures should be configured to identify 'related' btest connections that occur without a preceding authenticated primary session."

## References

[https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory ](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve)[https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Mitigation Third Party Advisory ](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)[https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 Release Notes ](https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802)[https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes ](https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801)[https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes ](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800)[https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory ](https://mikrotik.com/supportsec/september-2026-vulnerability/)[https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ Exploit Third Party Advisory ](https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-67277 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)