MikroTik RouterOS: Fixed in 6.49.21, 7.23.4 and 7.24.2 — 2 CVEs in CISA KEV

On September 10, 2026, CISA added two MikroTik RouterOS vulnerabilities to its KEV catalog, with a three-day remediation deadline. One yields a kernel memory leak without authentication, the other a privilege escalation.

Fixed versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).

MikroTik occupies a distinctive position: inexpensive, highly capable hardware, deployed heavily by regional ISPs, hosting providers, integrators and technical SMBs. It's also historically one of the most heavily botnet-enrolled platforms — the Mēris network, which set DDoS records, ran primarily on unpatched MikroTik devices.

CVE-2026-67277 — kernel memory leak via the btest service

The vendor description is unusually precise, and it actually describes two distinct bugs in the same service:

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With random-data=false, the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.

Bug 1 — the memory leak. The btest (Bandwidth Test) service generates traffic to measure throughput. With random-data=false, it fills packets from a kernel buffer without initialising it. That buffer's residual content therefore goes out over the network, to the attacker. This is an arbitrary kernel memory leak: credentials in transit, configuration fragments, session material — whatever happened to be there.

That's what explains the C:L (low confidentiality): the attacker doesn't choose what they read, they collect what passes through. But by repeating the operation, they accumulate.

Bug 2 — the kernel restart. An unchecked, inverted packet-size interval causes an unsigned integer underflow — a negative value becomes a very large positive one — producing anomalously large fragmented output and potentially restarting the RouterOS kernel. Hence the A:H: a denial of service on a router is a link outage.

The sequencing pattern

The starting condition is worth isolating: accepts a related connection before the primary session has completed authentication.

That's precisely the pattern behind the PaperCut chain published ten days ago, where a business action ran before access validation completed. Two unrelated vendors, two weeks apart, the same defect class: the check exists, but the operation overtakes it.

These are hard bugs to find in code review, because reading the code shows a check present. They only surface when reasoning about execution order — which is why they survive so long.

CVE-2026-86060 — privilege escalation

CISA's description:

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.

NVD has published no score, vector or version list at the time of writing — I won't invent them. What CISA's description does make clear is the mechanism: an argument delimiter injection allows modifying RouterOS's policy mask, i.e. the set of permissions granted to a user (read, write, policy, ftp, ssh…).

Changing that mask amounts to granting yourself the rights you lack. It's the natural complement to the first CVE: one yields material without authentication, the other escalates once inside.

Both were KEV-listed on the same day, which suggests a joint observation.

Versions

Check your version:

/system resource print

Or as a one-liner from a script:

ssh admin@router "/system resource print" | grep version

The existence of a 6.49 branch still maintained in 2026 tells you about the real installed base: many production MikroTik devices run RouterOS 6, sometimes for a decade, because they work and nobody has a reason to touch them.

What's Actually Exposed

The btest service shouldn't be reachable

This is the most actionable point in the article. The Bandwidth Test Server is a diagnostic tool, used occasionally to qualify a link. It has no reason to be permanently reachable, let alone from the internet.

Yet it's enabled by default in many configurations, and stays open because nobody disabled it after installation.

/tool bandwidth-server print

If it's enabled and unfiltered, the first CVE is exploitable against you from anywhere.

What a compromised router yields

• Traffic interception — the router sees everything passing through
• DNS modification, redirecting users without touching their machines
• Pivot into the internal network
• Botnet enrolment: the historic outcome on MikroTik, and why these devices are scanned continuously
• A durable observation post: with no agent and no exported logs, a compromised router runs normally for years

Detection

btest service

/tool bandwidth-server print
/log print where topics~"system"

Bandwidth test server usage you didn't initiate is a direct signal.

Users and policies

This is the check aimed at the second CVE — escalation goes through a policy mask change:

/user print detail
/user group print detail

Compare group policies against what you defined. Any permission added (policy, write, ftp) to a group that lacked it is an unambiguous indicator.

Configuration

/export compact

Export and compare against a known reference. Priority items:

• Modified DNS servers
• Added NAT and firewall rules
• Scripts and schedulers (/system script print, /system scheduler print) — the favourite persistence location on RouterOS
• Undocumented tunnels (L2TP, PPTP, WireGuard)
• Unknown SSH/API users

Persistence via scheduled script

/system scheduler print detail
/system script print detail

A scheduled script that downloads and executes content is the classic persistence pattern on this platform. On a healthy router, that list is short and known.

Mitigation

1. Update to your branch's release

/system package update check-for-updates
/system package update install

Verify the version after reboot — an interrupted RouterOS update leaves the device on the old version without clearly saying so.

2. Disable the btest server

Applicable immediately, with no interruption, and it neutralises CVE-2026-67277 regardless of version:

/tool bandwidth-server set enabled=no

If you have a legitimate occasional use, enable it when needed and close it afterwards. This isn't a service that should stay open.

3. Restrict administrative services

/ip service print
/ip service set winbox address=10.0.0.0/8
/ip service set ssh address=10.0.0.0/8
/ip service set api disabled=yes
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes

Disable everything you don't use, and restrict the rest to your management network. This is the measure that also protects against the next CVEs.

4. Verify there's no internet exposure

# From outside
nmap -Pn -p 21,22,23,80,443,2000,8291,8728,8729 <public-ip>

Port 8291 (Winbox) and 2000 (btest) should never answer from the internet.

5. If you suspect a compromise

On a compromised network device, cleaning in place isn't reliable:

1. Export the configuration for analysis, but don't re-import it as-is
2. Reset without default configuration: /system reset-configuration no-defaults=yes
3. Reconfigure by hand from your documentation, not from a potentially tampered backup
4. Change every password and regenerate SSH keys
5. Audit scripts and schedulers before reusing any configuration

Why Continuous Monitoring of Network Gear Matters

A MikroTik router has a ten-year service life and no automatic update mechanism. It appears in no software inventory, shows up in no OS scan, and its declared owner is often the integrator who installed it. The result: two KEV CVEs with a three-day deadline can pass entirely unnoticed — all the more so because the device keeps routing perfectly throughout.

With cveo.tech, inventory your routers, firewalls and network devices with their exact firmware versions, and get automatic alerts whenever a critical CVE targets one — so "am I affected?" has an immediate answer.