# CVE-2026-67277: MikroTik RouterOS missing authentication in btest service

Source: https://junglewise.ai/threats/cve-2026-67277-mikrotik-routeros-missing-authentication-in-btest-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-67277 · Severity: critical · CVSS 8.2 · Exploited in the wild · Published 2026-09-05

MikroTik RouterOS is widely used in network routers and gateways to manage enterprise and ISP networks. A missing authentication flaw in the btest service allows attackers without credentials to leak sensitive kernel memory and crash the device, disrupting network operations and potentially exposing internal system details. The vulnerability is actively being exploited by attackers.

Technologies: [MikroTik RouterOS](https://junglewise.ai/threats/technologies/routeros). Vendors: [MikroTik](https://junglewise.ai/threats/vendors/mikrotik).

## Quick answers

**Is CVE-2026-67277 exploited in the wild?** Yes. CVE-2026-67277 is known to be exploited in the wild, first recorded on 10 September 2026. Treat it as urgent.

**How severe is CVE-2026-67277?** Critical severity, with a CVSS score of 8.2, published 5 September 2026.

**Which products and versions are affected?** MikroTik RouterOS.

**Is there a fix for CVE-2026-67277?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67277 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-67277?** Check whether you run MikroTik RouterOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

MikroTik RouterOS contains a missing authentication vulnerability in the btest service, a critical component responsible for network diagnostics and testing functionality. The vulnerability allows unauthenticated remote attackers to invoke privileged functions without providing valid credentials. An attacker with network access can exploit this to read sensitive kernel memory, potentially disclosing cryptographic keys, configuration data, or other sensitive information, and trigger a denial of service by causing the service or device to crash. The vulnerability is network-reachable and requires no authentication or user interaction; exploitation is straightforward and is actively occurring in the wild.

## Affected products

- MikroTik RouterOS

## Timeline

- 2026-09-10: disclosed
- exploited: Being actively exploited in the wild

## Related threats

- [MikroTik RouterOS session token replay authentication bypass in WebFig](https://junglewise.ai/threats/cve-2026-89035-mikrotik-routeros-through-7-24-5-contains-a-session-token-replay)
- [MikroTik RouterOS integer overflow in ipt_SAME module](https://junglewise.ai/threats/cve-2026-112158-a-weakness-has-been-identified-in-mikrotik-routeros-up-to-6-40-5)
- [MikroTik RouterOS WinBox incorrect authorization in authentication](https://junglewise.ai/threats/cve-2026-103903-an-incorrect-authorization-vulnerability-in-the-winbox)
- [MikroTik RouterOS integer underflow](https://junglewise.ai/threats/cve-2026-84411-mikrotik-routeros)
- [MikroTik RouterOS improper input validation in BGP labelled-VPN NLRI](https://junglewise.ai/threats/cve-2026-93345-mikrotik-routeros-before-7-25beta4-contains-an-improper-input)