# CVE-2026-67281: MikroTik RouterOS WebFig uninitialized pointer file read

Source: https://junglewise.ai/threats/cve-2026-67281-routeros-webfig-contains-an-unauthenticated-file-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-67281 · Severity: high · CVSS 7.5 · Published 2026-09-05

MikroTik RouterOS WebFig is a web interface for managing router devices. This vulnerability allows an attacker without authentication to read sensitive files on the device, including configuration data and credentials, by exploiting a memory management flaw in the file-serving path.

Technologies: [MikroTik RouterOS](https://junglewise.ai/threats/technologies/routeros). Vendors: [MikroTik](https://junglewise.ai/threats/vendors/mikrotik).

## Quick answers

**Is CVE-2026-67281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67281 being exploited in the wild.

**How severe is CVE-2026-67281?** High severity, with a CVSS score of 7.5, published 5 September 2026.

**Which products and versions are affected?** MikroTik RouterOS 7.20 to 7.23.3, 7.24.0 to 7.24.1.

**Is there a fix for CVE-2026-67281?** A patch was published on 2026-09-05: Fixed in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67281 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67281?** Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-67281 is an access of uninitialized pointer (CWE-824) in RouterOS WebFig's /jsproxy path. An unauthenticated network attacker can exploit heap allocation timing to cause the file authorization logic to dereference a stale principal pointer with elevated privileges, then supply path traversal components in an encrypted URI to escape the WebFig namespace and read root-owned files.

## Affected products

- MikroTik RouterOS 7.20 to 7.23.3, 7.24.0 to 7.24.1

## Timeline

- 2026-09-05: disclosed
- 2026-09-05: patched: Fixed in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable)

## References

- [https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve)
- [https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)

## Related threats

- [MikroTik RouterOS session token replay authentication bypass in WebFig](https://junglewise.ai/threats/cve-2026-89035-mikrotik-routeros-through-7-24-5-contains-a-session-token-replay)
- [MikroTik RouterOS integer overflow in ipt_SAME module](https://junglewise.ai/threats/cve-2026-112158-a-weakness-has-been-identified-in-mikrotik-routeros-up-to-6-40-5)
- [MikroTik RouterOS WinBox incorrect authorization in authentication](https://junglewise.ai/threats/cve-2026-103903-an-incorrect-authorization-vulnerability-in-the-winbox)
- [MikroTik RouterOS integer underflow](https://junglewise.ai/threats/cve-2026-84411-mikrotik-routeros)
- [MikroTik RouterOS improper input validation in BGP labelled-VPN NLRI](https://junglewise.ai/threats/cve-2026-93345-mikrotik-routeros-before-7-25beta4-contains-an-improper-input)