Quick answers
- Is CVE-2026-67281 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67281 being exploited in the wild.
- How severe is CVE-2026-67281?
- High severity, with a CVSS score of 7.5, published 5 September 2026.
- Which products and versions are affected?
- MikroTik RouterOS 7.20 to 7.23.3, 7.24.0 to 7.24.1.
- Is there a fix for CVE-2026-67281?
- A patch was published on 2026-09-05: Fixed in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-67281 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-67281?
- Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-67281 is an access of uninitialized pointer (CWE-824) in RouterOS WebFig's /jsproxy path. An unauthenticated network attacker can exploit heap allocation timing to cause the file authorization logic to dereference a stale principal pointer with elevated privileges, then supply path traversal components in an encrypted URI to escape the WebFig namespace and read root-owned files.
Affected products
- MikroTik RouterOS 7.20 to 7.23.3, 7.24.0 to 7.24.1
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: Fixed in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable)