Affected Systems

MikroTik RouterOS versions 6.0.0 to 6.49.20, 7.0.0 to 7.23.3, and 7.24 to 7.24.1. All six CVEs affect the same version ranges. Impacts SSH authentication, TLS certificate validation, WebFig interface, and bandwidth test functionality.

Exploitation Status

No active exploitation reported. CERT Polska disclosed these vulnerabilities through coordinated disclosure. Technical details published, increasing likelihood of exploit development. CVE-2026-67277, CVE-2026-67279, and CVE-2026-67281 allow unauthenticated remote exploitation.

Business Impact

MikroTik routers are widely deployed in enterprise, ISP, and SOHO environments. Multiple vulnerabilities allow unauthenticated attackers to bypass SSH authentication (CVE-2026-67276, CVE-2026-67279), execute arbitrary commands, read sensitive configuration files including credentials (CVE-2026-67281), escalate privileges (CVE-2026-86060), cause denial of service (CVE-2026-67277), and perform TLS man-in-the-middle attacks (CVE-2026-67278). Combined exploitation could result in full device compromise, credential theft, network pivoting, and persistent backdoor installation. Internet-facing SSH and WebFig interfaces are at highest risk.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately upgrade all MikroTik RouterOS devices to version 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) or later
  • Identify all MikroTik devices in your environment using asset inventory or network scanning; prioritize those with SSH or WebFig exposed to untrusted networks
  • Disable remote SSH and WebFig access on internet-facing MikroTik routers until patching is complete; restrict management access to trusted IP ranges via firewall rules
  • Review RouterOS logs for suspicious SSH authentication attempts, unusual file access via WebFig (/jsproxy path), and unexpected bandwidth test sessions from September 2026 backward
  • Rotate credentials and review configuration backups on all MikroTik devices, especially if CVE-2026-67281 exploitation (unauthenticated file read) is suspected

---

# Geopolitical Context

Geopolitical Context

CERT Polska's disclosure of six vulnerabilities in MikroTik RouterOS—a widely deployed routing platform in critical infrastructure, small and medium enterprises, and internet service providers globally—represents a significant contribution to global cybersecurity resilience. MikroTik devices are prevalent in Eastern Europe, Central Asia, and developing markets, where they often serve as edge infrastructure with limited security oversight. The vulnerabilities span authentication bypass (CVE-2026-67277, CVE-2026-67279), cryptographic signature verification flaws (CVE-2026-67276, CVE-2026-67278), privilege escalation (CVE-2026-86060), and unauthenticated file disclosure (CVE-2026-67281). Collectively, these flaws enable remote unauthenticated attackers to gain administrative access, exfiltrate credentials, and manipulate device configurations. Poland's national CERT conducting independent vulnerability research and coordinating responsible disclosure reflects the country's growing role as a regional cybersecurity hub within NATO and the EU. This proactive posture is consistent with Poland's strategic emphasis on cyber defense amid heightened threat activity in the region, particularly from actors historically targeting network infrastructure for espionage, pre-positioning, and disruptive operations.

State Actor Alignment

No state actor attribution is provided in this disclosure. However, MikroTik devices have historically been exploited by multiple advanced persistent threat (APT) groups. Previous campaigns attributed to Russian military intelligence (GRU) units, including activity linked to Sandworm and other actors, have leveraged MikroTik routers for command-and-control infrastructure, VPN pivoting, and targeting of Ukrainian and European networks. Chinese and Iranian threat actors have also been observed exploiting router vulnerabilities for strategic access. The severity of these flaws—particularly the authentication bypass and credential theft vectors—suggests they may be attractive to state-sponsored actors seeking persistent access to network edge devices. Poland's decision to publicly disclose these vulnerabilities, rather than retain them for intelligence purposes, aligns with NATO and EU norms promoting coordinated vulnerability disclosure and collective defense. The timing and transparency of this disclosure may also serve to reduce adversary operational advantage in a region where network infrastructure remains a contested domain.

Business Impacty pro region

The disclosure has immediate implications for Europe, where MikroTik devices are widely deployed in both enterprise and critical infrastructure environments, particularly in Central and Eastern Europe. Countries bordering Ukraine and Russia, including Poland, the Baltic states, and Romania, face elevated risk from threat actors seeking to pre-position in network infrastructure for intelligence collection or contingency operations. The vulnerabilities' severity—enabling full device compromise without authentication—poses risks to sectors including telecommunications, energy, and government networks. Globally, the disclosure affects regions with high MikroTik adoption, including Central Asia, the Middle East, and parts of Africa and Latin America, where patching cadence may lag and devices remain exposed. The European Union Agency for Cybersecurity (ENISA) and national CERTs across the EU are likely to issue advisories urging immediate patching. For NATO members, the disclosure underscores the strategic importance of securing edge infrastructure as part of collective defense posture. The vulnerabilities also highlight supply chain and vendor security challenges, as MikroTik's Latvian origins and global customer base intersect with geopolitical fault lines.

Forecast

If exploitation activity targeting these vulnerabilities emerges in the coming weeks, it is likely to focus initially on reconnaissance and credential harvesting, particularly in regions with slower patch adoption. State-sponsored actors may seek to exploit the authentication bypass and file disclosure flaws to gain persistent access to edge devices for intelligence purposes. If proof-of-concept code becomes publicly available, opportunistic cybercriminal activity—including botnet recruitment and ransomware pre-positioning—may follow. Organizations in Eastern Europe, the Baltics, and Ukraine should anticipate heightened scanning and exploitation attempts. If MikroTik's patch adoption remains uneven, particularly in under-resourced sectors and regions, these vulnerabilities may contribute to a sustained expansion of compromised router infrastructure available for use in future campaigns. European and NATO cybersecurity authorities are likely to intensify monitoring of MikroTik devices and may issue binding patching directives for critical infrastructure operators. If adversary exploitation is detected and attributed, it may prompt coordinated diplomatic or sanctions responses, particularly if targeting aligns with ongoing geopolitical tensions in the region.