Quick answers
- Is CVE-2026-67277 exploited in the wild?
- Yes. CVE-2026-67277 is known to be exploited in the wild, first recorded on 10 September 2026. Treat it as urgent.
- How severe is CVE-2026-67277?
- Critical severity, with a CVSS score of 8.2, published 5 September 2026.
- Which products and versions are affected?
- MikroTik RouterOS.
- Is there a fix for CVE-2026-67277?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-67277 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-67277?
- Check whether you run MikroTik RouterOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
MikroTik RouterOS contains a missing authentication vulnerability in the btest service, a critical component responsible for network diagnostics and testing functionality. The vulnerability allows unauthenticated remote attackers to invoke privileged functions without providing valid credentials. An attacker with network access can exploit this to read sensitive kernel memory, potentially disclosing cryptographic keys, configuration data, or other sensitive information, and trigger a denial of service by causing the service or device to crash. The vulnerability is network-reachable and requires no authentication or user interaction; exploitation is straightforward and is actively occurring in the wild.
Affected products
- MikroTik RouterOS
Timeline
- 2026-09-10: disclosed
- exploited: Being actively exploited in the wild