{"schema_version":1,"title":"MikroTik vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in MikroTik: 1 in the last 7 days and 15 in the last 90 days, 6 of them critical and 5 exploited in the wild. The most recent, CVE-2026-93345, was published on 22 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/mikrotik","json_url":"https://junglewise.ai/threats/vendors/mikrotik.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/mikrotik","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":6,"all_time":18,"critical":6,"exploited":5,"last_7_days":1,"last_30_days":12,"last_90_days":15,"last_365_days":16},"latest":[{"cve":"CVE-2026-93345","cvss":7.5,"epss":0.0049,"slug":"cve-2026-93345-mikrotik-routeros-before-7-25beta4-contains-an-improper-input","title":"MikroTik RouterOS improper input validation in BGP labelled-VPN NLRI","severity":"high","exploited":false,"published_at":"2026-09-22T18:17:30.37+00:00","url":"https://junglewise.ai/threats/cve-2026-93345-mikrotik-routeros-before-7-25beta4-contains-an-improper-input"},{"cve":"CVE-2025-56566","cvss":4.6,"epss":0.0016,"slug":"cve-2025-56566-mikrotik-firmware-cleartext-credential-storage","title":"MikroTik firmware cleartext credential storage","severity":"medium","exploited":false,"published_at":"2026-09-16T21:17:06.767+00:00","url":"https://junglewise.ai/threats/cve-2025-56566-mikrotik-firmware-cleartext-credential-storage"},{"cve":"CVE-2026-89028","cvss":7.5,"epss":0.0058,"slug":"cve-2026-89028-mikrotik-routeros-heap-corruption-in-smb1-sessionsetupandx","title":"MikroTik RouterOS heap corruption in SMB1 SessionSetupAndX","severity":"high","exploited":false,"published_at":"2026-09-16T14:17:12.887+00:00","url":"https://junglewise.ai/threats/cve-2026-89028-mikrotik-routeros-heap-corruption-in-smb1-sessionsetupandx"},{"cve":"CVE-2026-56719","cvss":6.5,"epss":0.0039,"slug":"cve-2026-56719-mikrotik-routeros-out-of-bounds-read-in-smb-daemon","title":"MikroTik RouterOS out-of-bounds read in SMB daemon","severity":"medium","exploited":false,"published_at":"2026-09-16T14:17:05.483+00:00","url":"https://junglewise.ai/threats/cve-2026-56719-mikrotik-routeros-out-of-bounds-read-in-smb-daemon"},{"cve":"CVE-2026-89021","cvss":6.9,"epss":0.0038,"slug":"cve-2026-89021-mikrotik-routeros-path-traversal-in-container-oci-tar-extraction","title":"MikroTik RouterOS path traversal in container OCI/tar extraction","severity":"medium","exploited":false,"published_at":"2026-09-14T19:17:54.723+00:00","url":"https://junglewise.ai/threats/cve-2026-89021-mikrotik-routeros-path-traversal-in-container-oci-tar-extraction"},{"cve":"CVE-2026-89020","cvss":4.3,"epss":0.0049,"slug":"cve-2026-89020-mikrotik-routeros-stack-buffer-overflow-in-tftp-client","title":"MikroTik RouterOS stack buffer overflow in TFTP client","severity":"medium","exploited":false,"published_at":"2026-09-14T19:17:54.563+00:00","url":"https://junglewise.ai/threats/cve-2026-89020-mikrotik-routeros-stack-buffer-overflow-in-tftp-client"},{"cve":"CVE-2026-86060","cvss":9.8,"epss":0.0185,"slug":"cve-2026-86060-mikrotik-routeros-argument-delimiter-neutralization-privilege","title":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for t","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.703+00:00","url":"https://junglewise.ai/threats/cve-2026-86060-mikrotik-routeros-argument-delimiter-neutralization-privilege"},{"cve":"CVE-2026-67281","cvss":7.5,"epss":0.0061,"slug":"cve-2026-67281-routeros-webfig-contains-an-unauthenticated-file-read","title":"MikroTik RouterOS WebFig uninitialized pointer file read","severity":"high","exploited":false,"published_at":"2026-09-05T20:17:18.547+00:00","url":"https://junglewise.ai/threats/cve-2026-67281-routeros-webfig-contains-an-unauthenticated-file-read"},{"cve":"CVE-2026-67279","cvss":6.5,"epss":0.0071,"slug":"cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement","title":"RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.39+00:00","url":"https://junglewise.ai/threats/cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement"},{"cve":"CVE-2026-67278","cvss":9.1,"epss":0.0028,"slug":"cve-2026-67278-mikrotik-routeros-accepts-malformed-rsa-pkcs-1-v1-5-signatures","title":"MikroTik RouterOS malformed RSA/PKCS#1 v1.5 signature acceptance","severity":"critical","exploited":false,"published_at":"2026-09-05T20:17:18.257+00:00","url":"https://junglewise.ai/threats/cve-2026-67278-mikrotik-routeros-accepts-malformed-rsa-pkcs-1-v1-5-signatures"},{"cve":"CVE-2026-67277","cvss":8.2,"epss":0.0156,"slug":"cve-2026-67277-mikrotik-routeros-missing-authentication-in-btest-service","title":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated clie","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.12+00:00","url":"https://junglewise.ai/threats/cve-2026-67277-mikrotik-routeros-missing-authentication-in-btest-service"},{"cve":"CVE-2026-67276","cvss":8.1,"epss":0.0037,"slug":"cve-2026-67276-routeros-does-not-compare-the-complete-rsa-public-key-when","title":"MikroTik RouterOS SSH RSA public key comparison bypass","severity":"high","exploited":false,"published_at":"2026-09-05T20:17:17.977+00:00","url":"https://junglewise.ai/threats/cve-2026-67276-routeros-does-not-compare-the-complete-rsa-public-key-when"},{"cve":"CVE-2026-14227","cvss":4.9,"slug":"cve-2026-14227-mikrotik-routeros-insufficient-session-expiration-in-api","title":"MikroTik RouterOS insufficient session expiration in API","severity":"medium","exploited":false,"published_at":"2026-07-30T19:17:07.493+00:00","url":"https://junglewise.ai/threats/cve-2026-14227-mikrotik-routeros-insufficient-session-expiration-in-api"},{"cve":"CVE-2026-16347","cvss":8.8,"slug":"cve-2026-16347-mikrotik-routeros-improper-restriction-of-excessive","title":"MikroTik RouterOS improper restriction of excessive authentication attempts in API","severity":"high","exploited":false,"published_at":"2026-07-28T20:17:23.713+00:00","url":"https://junglewise.ai/threats/cve-2026-16347-mikrotik-routeros-improper-restriction-of-excessive"},{"cve":"CVE-2026-39042","cvss":0,"slug":"cve-2026-39042-mikrotik-routeros-denial-of-service-in-libumsg-so-unflatten","title":"MikroTik RouterOS denial of service in libumsg.so unflatten function","severity":"info","exploited":false,"published_at":"2026-07-13T22:16:46.247+00:00","url":"https://junglewise.ai/threats/cve-2026-39042-mikrotik-routeros-denial-of-service-in-libumsg-so-unflatten"},{"cve":"CVE-2026-7668","cvss":7.3,"epss":0.0005,"slug":"cve-2026-7668-mikrotik-routeros-out-of-bounds-read-in-scep-endpoint","title":"MikroTik RouterOS out-of-bounds read in SCEP Endpoint","severity":"high","exploited":false,"published_at":"2026-05-02T21:16:07.677+00:00","url":"https://junglewise.ai/threats/cve-2026-7668-mikrotik-routeros-out-of-bounds-read-in-scep-endpoint"},{"cve":"CVE-2018-7445","cvss":9.8,"slug":"cve-2018-7445-mikrotik-routeros-stack-based-buffer-overflow-vulnerability","title":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","severity":"critical","exploited":true,"published_at":"2022-09-08T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2018-7445-mikrotik-routeros-stack-based-buffer-overflow-vulnerability"},{"cve":"CVE-2018-14847","cvss":9.1,"slug":"cve-2018-14847-mikrotik-router-os-directory-traversal-vulnerability","title":"MikroTik Router OS Directory Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2021-12-01T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2018-14847-mikrotik-router-os-directory-traversal-vulnerability"}],"vendor":{"hub":true,"name":"MikroTik","slug":"mikrotik","homepage":"https://mikrotik.com/","description":"A Latvian network equipment manufacturer that develops routers, switches, and wireless systems.","url":"https://junglewise.ai/threats/vendors/mikrotik"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":4,"exploited":3,"vulnerabilities":6},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"most_severe":[{"cve":"CVE-2026-86060","cvss":9.8,"epss":0.0185,"slug":"cve-2026-86060-mikrotik-routeros-argument-delimiter-neutralization-privilege","title":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for t","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.703+00:00","url":"https://junglewise.ai/threats/cve-2026-86060-mikrotik-routeros-argument-delimiter-neutralization-privilege"},{"cve":"CVE-2018-7445","cvss":9.8,"slug":"cve-2018-7445-mikrotik-routeros-stack-based-buffer-overflow-vulnerability","title":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","severity":"critical","exploited":true,"published_at":"2022-09-08T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2018-7445-mikrotik-routeros-stack-based-buffer-overflow-vulnerability"},{"cve":"CVE-2018-14847","cvss":9.1,"slug":"cve-2018-14847-mikrotik-router-os-directory-traversal-vulnerability","title":"MikroTik Router OS Directory Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2021-12-01T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2018-14847-mikrotik-router-os-directory-traversal-vulnerability"},{"cve":"CVE-2026-67277","cvss":8.2,"epss":0.0156,"slug":"cve-2026-67277-mikrotik-routeros-missing-authentication-in-btest-service","title":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated clie","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.12+00:00","url":"https://junglewise.ai/threats/cve-2026-67277-mikrotik-routeros-missing-authentication-in-btest-service"},{"cve":"CVE-2026-67279","cvss":6.5,"epss":0.0071,"slug":"cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement","title":"RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.39+00:00","url":"https://junglewise.ai/threats/cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement"},{"cve":"CVE-2026-67278","cvss":9.1,"epss":0.0028,"slug":"cve-2026-67278-mikrotik-routeros-accepts-malformed-rsa-pkcs-1-v1-5-signatures","title":"MikroTik RouterOS malformed RSA/PKCS#1 v1.5 signature acceptance","severity":"critical","exploited":false,"published_at":"2026-09-05T20:17:18.257+00:00","url":"https://junglewise.ai/threats/cve-2026-67278-mikrotik-routeros-accepts-malformed-rsa-pkcs-1-v1-5-signatures"},{"cve":"CVE-2026-16347","cvss":8.8,"slug":"cve-2026-16347-mikrotik-routeros-improper-restriction-of-excessive","title":"MikroTik RouterOS improper restriction of excessive authentication attempts in API","severity":"high","exploited":false,"published_at":"2026-07-28T20:17:23.713+00:00","url":"https://junglewise.ai/threats/cve-2026-16347-mikrotik-routeros-improper-restriction-of-excessive"},{"cve":"CVE-2026-67276","cvss":8.1,"epss":0.0037,"slug":"cve-2026-67276-routeros-does-not-compare-the-complete-rsa-public-key-when","title":"MikroTik RouterOS SSH RSA public key comparison bypass","severity":"high","exploited":false,"published_at":"2026-09-05T20:17:17.977+00:00","url":"https://junglewise.ai/threats/cve-2026-67276-routeros-does-not-compare-the-complete-rsa-public-key-when"},{"cve":"CVE-2026-67281","cvss":7.5,"epss":0.0061,"slug":"cve-2026-67281-routeros-webfig-contains-an-unauthenticated-file-read","title":"MikroTik RouterOS WebFig uninitialized pointer file read","severity":"high","exploited":false,"published_at":"2026-09-05T20:17:18.547+00:00","url":"https://junglewise.ai/threats/cve-2026-67281-routeros-webfig-contains-an-unauthenticated-file-read"},{"cve":"CVE-2026-89028","cvss":7.5,"epss":0.0058,"slug":"cve-2026-89028-mikrotik-routeros-heap-corruption-in-smb1-sessionsetupandx","title":"MikroTik RouterOS heap corruption in SMB1 SessionSetupAndX","severity":"high","exploited":false,"published_at":"2026-09-16T14:17:12.887+00:00","url":"https://junglewise.ai/threats/cve-2026-89028-mikrotik-routeros-heap-corruption-in-smb1-sessionsetupandx"}],"generated_at":"2026-09-26T11:07:00.153785+00:00","technologies":[{"name":"MikroTik RouterOS","slug":"routeros","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/routeros"}]}