Is CVE-2026-89021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89021 being exploited in the wild.

How severe is CVE-2026-89021?

Medium severity, with a CVSS score of 6.9, published 14 September 2026.

Which products and versions are affected?

MikroTik RouterOS before 7.24.2; 7.23.x long-term branch.

Is there a fix for CVE-2026-89021?

A patch was published on 2026-09-03: Fix released in RouterOS 7.24.2 stable; 7.23.x long-term branch not patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89021 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-89021?

Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89021: MikroTik RouterOS path traversal in container OCI/tar extraction

CVE-2026-89021 · Severity: medium · CVSS 6.9 · Published 2026-09-14

MikroTik RouterOS is an operating system for network routers that includes a container runtime feature for running isolated applications. A path traversal vulnerability in the container image extraction process allows attackers to write files to arbitrary locations on the router with root privileges by uploading a specially crafted container image, potentially compromising the entire device and its network.

Technologies: MikroTik RouterOS. Vendors: MikroTik.

Quick answers

Is CVE-2026-89021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89021 being exploited in the wild.
How severe is CVE-2026-89021?: Medium severity, with a CVSS score of 6.9, published 14 September 2026.
Which products and versions are affected?: MikroTik RouterOS before 7.24.2; 7.23.x long-term branch.
Is there a fix for CVE-2026-89021?: A patch was published on 2026-09-03: Fix released in RouterOS 7.24.2 stable; 7.23.x long-term branch not patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89021 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-89021?: Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal (CWE-22) and symlink-following (CWE-59) flaw in the OCI/tar image extraction logic within RouterOS's container package. During container import via the /container/add endpoint, unsanitized tar member paths are extracted, allowing an attacker to supply a crafted image containing symlinks pointing to arbitrary filesystem paths. An authenticated user with container management privileges can exploit this to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition—all without starting the container. The attack requires network access and high privileges (container admin role), with possible user interaction for image import. A fix is available in RouterOS 7.24.2 and later stable releases, but the vulnerability remains unpatched in the 7.23.x long-term branch with no backport planned.

Affected products

MikroTik RouterOS before 7.24.2; 7.23.x long-term branch

Timeline

2026-09-14: disclosed
2026-09-03: patched: Fix released in RouterOS 7.24.2 stable; 7.23.x long-term branch not patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.