Mikrotik vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Mikrotik flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral WorkflowExploited since Sep 25, 2026 · CVSS 6.9
• CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a CommandExploited since Sep 10, 2026 · CVSS 9.2
• CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical FunctionExploited since Sep 10, 2026 · CVSS 8.8
• CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer OverflowExploited since Sep 8, 2022 · CVSS 9.8
• CVE-2018-14847 MikroTik Router OS Directory TraversalExploited since Dec 1, 2021 · CVSS 9.1

Latest high and critical flaws

• CVE-2026-89035 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replayiCritical 9.1 · Oct 21, 2026
• CVE-2026-112158 A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8.High 7.1 · Oct 19, 2026
• CVE-2026-103903 An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a loHigh 8.7 · Oct 12, 2026
• CVE-2026-84411 The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authenticationCritical 9.3 · Oct 2, 2026
• CVE-2026-93345 MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an High 8.7 · Sep 22, 2026
• CVE-2026-89028 MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap High 8.2 · Sep 16, 2026
• CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a CommandExploited · Critical 9.2 · Sep 5, 2026
• CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principalHigh 8.7 · Sep 5, 2026
• CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical FunctionExploited · High 8.8 · Sep 5, 2026
• CVE-2026-67276 RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus bCritical 9.2 · Sep 5, 2026
• CVE-2026-16347 MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts.High 8.7 · Jul 28, 2026
• CVE-2025-10948 A vulnerability has been found in MikroTik RouterOS 7.High 7.4 · Sep 25, 2025
• CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability.High 7.2 · Jun 25, 2025
• CVE-2024-54952 MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability.High 7.5 · May 29, 2025
• CVE-2023-32154 Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability.High 7.5 · May 2, 2024
• CVE-2024-2169 Implementations of UDP application protocol are vulnerable to network loops.High 7.5 · Mar 19, 2024
• CVE-2023-30800 The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue.High 7.5 · Sep 7, 2023
• CVE-2023-30799 MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue.Critical 9.1 · Jul 19, 2023
• CVE-2020-20021 An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.High 7.5 · Jul 12, 2023
• CVE-2023-24094 An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.High 7.5 · Mar 27, 2023
• CVE-2022-45313 Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process.High 8.8 · Dec 5, 2022
• CVE-2017-20149 The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red.Critical 9.8 · Oct 14, 2022
• CVE-2022-34960 The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hostCritical 9.8 · Aug 24, 2022
• CVE-2021-41987 In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution.High 8.1 · Mar 16, 2022
• CVE-2020-22845 A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.High 7.5 · Feb 28, 2022