Quick answers
- Is CVE-2026-89035 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89035 being exploited in the wild.
- How severe is CVE-2026-89035?
- High severity, with a CVSS score of 7.4, published 21 October 2026.
- Which products and versions are affected?
- MikroTik RouterOS through 7.24.5, including 7.23.6 and earlier.
- Is there a fix for CVE-2026-89035?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-89035 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-89035?
- Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The makeSessionKey function in libucrypto.so generates session tokens using fixed salts without incorporating channel-specific or session-specific input, allowing tokens generated in one ECDH session to remain valid across different sessions. The user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability compounds the exposure of CVE-2025-61481 by providing a practical exploitation path for captured session tokens.
Affected products
- MikroTik RouterOS through 7.24.5, including 7.23.6 and earlier
Timeline
- 2026-10-21: disclosed