RouterOS
- Software type
- Network operating system
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/15/2026, RouterOS recorded 15 security vulnerabilities in the last 90 days, of which 9 are rated High or Critical. Notably, 3 of these vulnerabilities are actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of RouterOS and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-103903MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalationCVE-2026-84411MikroTik RouterOS Integer UnderflowCVE-2026-93345MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRICVE-2026-89028MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndXCVE-2026-56719MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-103903MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-84411MikroTik RouterOS Integer Underflow | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityCritical |
|---|
CVE-2026-93345MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI | Exploitation statusNot exploited | FixYes | Published09/22/2026 | SeverityHigh |
|---|
CVE-2026-89028MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-56719MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-89021MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction | Exploitation statusNot exploited | FixYes | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-89020MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path | Exploitation statusNot exploited | FixYes | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Exploitation statusKEV | FixYes | Published09/05/2026 | SeverityCritical |
|---|
CVE-2026-67281Unauthenticated file read in Mikrotik RouterOS | Exploitation statusActively exploited | FixYes | Published09/05/2026 | SeverityHigh |
|---|
CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Exploitation statusKEV | FixYes | Published09/05/2026 | SeverityMedium |
|---|
101 Results | Page 1 of 11