Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-112158, Summary: A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
Serial number: AV26-1029 Date: October 13, 2026 As of October 12, 2026, MikroTik is affected by a vulnerability in the following product: RouterOS Prior to 7.24.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. MikroTik Downloads MikroTik Community Forum
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: , Summary: A remote authenticated user with read-only credentials can specify a full administrative account during stage two to obtain an admin session and persistently escalate privileges without knowing the admin password. Upgrade MikroTik RouterOS to version 7.24.5 (stable), 7.25rc1 (testing), or a later version. Verification tests confirm that the split-principal authentication flow is…
Aggiornamenti di sicurezza per MikroTik RouterOS sanano una vulnerabilità con gravità "alta". Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato remoto autenticato di eludere i meccanismi di sicurezza ed elevare i propri privilegi sui sistemi interessati.
Serial number: AV26-992 Date: October 2, 2026 As of September 29, 2026, MikroTik is affected by vulnerabilities in the following product: RouterOS Prior to 7.24 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. MikroTik RouterOS - CVE-2026-84411
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. [...]
Serial number: AV26-958Date: September 23, 2026 As of September 22, 2026, MikroTik is affected by a vulnerability in the following product: RouterOS Prior to 7.25beta5 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. 7.25beta [development] is released!
We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.
For the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1. Exposed data included names and government identification numbers, while a criminal marketplace advertised a collection containing millions of identity documents, including driver’s licenses, associated with the…
Number: AL26-020Date: September 10, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Cyber…
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational…
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv4.0: 9.2, CVEs: CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060, CVE-2026-67277, CVE-2026-67276, Summary: MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. There is evidence that these vulnerabilities are under active exploitation. This is an important security update. Most configurations are not at risk, but upgrading is highly…
CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version of RouterOS and its SSH remote-management service is accessible from the internet. Attackers are exploiting two…
MikroTik heeft meerdere kwetsbaarheden verholpen in RouterOS. De eerste kwetsbaarheid betreft een fout in de SSH-authenticatiemechanisme waarbij de exponent van RSA-sleutels niet werd geverifieerd. Hierdoor kunnen aanvallers RSA-handtekeningen vervalsen en ongeautoriseerde SSH-toegang verkrijgen. De tweede kwetsbaarheid betreft een probleem met gebruikersnamen die beginnen met een verboden teken, waardoor de trusted policy mask kan worden gemanipuleerd en privilege escalation mogelijk is binnen…
Národné centrum kybernetickej bezpečnosti (NCKB) NBÚ varuje pred útokmi na smerovače značky MikroTik. Útočníci zreťazením bezpečnostných zraniteľností operačného systému MikroTik RouterOS dokážu získať úplnú kontrolu nad zariadením bez potreby autentifikácie. MikroTik routre sú sieťové zariadenia vyrábané spoločnosťou MikroTik a využívajú vlastný operačný systém RouterOS. Využívané sú poskytovateľmi internetových služieb, v komerčnej sfére a rovnako aj v domácnostiach.... The post VAROVANIE:…
Upozorňujeme na zranitelnost ve firmware RouterOS v zařízeních MikroTik, kterou lze před autentizací zneužít k vzdálenému spuštění kódu s administrátorskými oprávněními. Aktuálně dochází k masovému zneužití této zranitelnosti. Dne 4. září 2026 byla vydána aktualizace RouterOS, v současnosti jsou však na internetu v ČR stále vystaveny tisíce zranitelných zařízení. Útočníci navíc u napadených zařízení upravují konfiguraci, aby si zajistili trvalý přístup k zařízení, který přežije jakoukoli…
Mikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise. Attackers have been adding new accounts to affected devices to maintain access after a patch is installed. The patch will attempt to detect compromise and set the "Flagged" status. Details: https://mikrotik.com/supportsec/september-2026-vulnerability -- Johannes B. Ullrich, Ph.D. , Dean of…
The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS, including two critical ones. The vulnerabilities are already being actively exploited to take over devices whose SSH service is accessible from the internet. We recommend immediately updating devices to the patched versions and verifying the configuration for signs of compromise.
Summary RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate validation logic which uses the system certificate store that is shared and equally trusted by all system services. This causes confusion of scope, allowing any certificate authority present in the system-wide trust store…