Is CVE-2026-93345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93345 being exploited in the wild.

How severe is CVE-2026-93345?

High severity, with a CVSS score of 7.5, published 22 September 2026.

Which products and versions are affected?

MikroTik RouterOS before 7.25beta4; 7.24.2 and 7.23.5 remain affected.

Is there a fix for CVE-2026-93345?

A patch was published on 2026-09-10: Fix included in 7.25beta4 development release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93345 attacked?

It is attacked over the network or from the adjacent network, in an operating system.

Am I affected by CVE-2026-93345?

Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93345: MikroTik RouterOS improper input validation in BGP labelled-VPN NLRI

CVE-2026-93345 · Severity: high · CVSS 7.5 · Published 2026-09-22

MikroTik RouterOS is a network operating system that runs on routers and manages network traffic. An unauthenticated attacker positioned on the network path can crash the BGP (Border Gateway Protocol) service by sending malformed routing messages, causing the router to drop BGP sessions and disrupting network connectivity. An attacker can repeatedly exploit this to keep the BGP service down indefinitely.

Technologies: MikroTik RouterOS. Vendors: MikroTik.

Quick answers

Is CVE-2026-93345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93345 being exploited in the wild.
How severe is CVE-2026-93345?: High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?: MikroTik RouterOS before 7.25beta4; 7.24.2 and 7.23.5 remain affected.
Is there a fix for CVE-2026-93345?: A patch was published on 2026-09-10: Fix included in 7.25beta4 development release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93345 attacked?: It is attacked over the network or from the adjacent network, in an operating system.
Am I affected by CVE-2026-93345?: Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation flaw in the labelled-VPN NLRI iterators of the BGP routing service. An unauthenticated on-path attacker can send a malformed MP_REACH_NLRI UPDATE message with an out-of-bounds prefix-length value for VPNv4 or VPNv6 routes, causing negative-length address calculations that trigger a service crash. Exploitation requires network access to the BGP session (adjacent network vector) and does not require authentication.

Affected products

MikroTik RouterOS before 7.25beta4; 7.24.2 and 7.23.5 remain affected

Timeline

2026-09-22: disclosed: CVE-2026-93345 published
2026-09-10: patched: Fix included in 7.25beta4 development release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.