MikroTik vulnerabilities
28 CVEs and advisories name MikroTik as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-89035MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
- CVE-2026-112158MikroTik RouterOS ipt_SAME.ko same_check integer overflow
- CVE-2026-103903MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
- CVE-2026-84411MikroTik RouterOS Integer Underflow
- CVE-2026-93345MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
- CVE-2026-89028MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
- CVE-2026-56719MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX
- CVE-2026-89021MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
- CVE-2026-89020MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation
- CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
- CVE-2026-67281Unauthenticated file read in Mikrotik RouterOS
- CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
- CVE-2026-67278TLS server impersonation possible in Mikrotik RouterOS
- CVE-2026-67277Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
- CVE-2026-67276SSH user impersonation possible in Mikrotik RouterOS
- CVE-2026-14227Insufficient session expiration in MikroTik RouterOS
- CVE-2026-16347Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router
- CVE-2025-42611Improper certificate validation in multiple RouterOS services
- CVE-2026-7668MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds
- CVE-2025-10948MikroTik RouterOS libjson.so print parse_json_element buffer overflow
- CVE-2025-6563Cross-site scripting via dst parameter in RouterOS WiFi hotspot
- CVE-2025-6443Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability
- CVE-2023-32154Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-2169Implementations of UDP application protocols are susceptible to network loops and denial of service
- CVE-2023-30800MikroTik RouterOS Web Interface Heap Corruption
- CVE-2023-30799MikroTik RouterOS Administrator Privilege Escalation
- CVE-2019-3981MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks.
- CVE-2019-3943MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an auth