CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
Overview
MikroTik RouterOS contains a missing authentication flaw in its bandwidth-test (btest) service that allows any unauthenticated network attacker to trigger kernel memory disclosure or crash the device. The service accepts a secondary "related" connection before the primary session has authenticated, granting access to a privileged state without credentials. Affected versions span the v6 branch below 6.49.21 and the v7 branch below 7.23.4 (long-term) or 7.24.2 (stable). The vulnerability is actively exploited in the wild as part of the broader MikroTrick attack campaign.
Vulnerability details
The btest service in RouterOS fails to enforce authentication before accepting a "related" secondary connection, a violation of CWE-306 (Missing Authentication for Critical Function). This trust-boundary failure lets an unauthenticated client reach a session state that should only be available after login. Once in that state, two compounding flaws activate: running a UDP test with random-data=false causes the service to transmit uninitialized kernel packet buffer contents, and a separate unchecked inverted packet-size interval triggers an unsigned integer underflow producing anomalously large fragmented output.
An attacker with network access to the btest service sends a crafted "related" connection request, bypassing the authentication gate entirely. Setting random-data=false in the test parameters causes the router to return uninitialized kernel memory to the attacker, disclosing potentially sensitive data from the kernel buffer. Supplying a malformed inverted packet-size interval triggers the integer underflow, which can force a kernel restart and take the device offline. No credentials are required at any stage, and CERT Polska has confirmed active exploitation of RouterOS devices reachable from the internet.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Check RouterOS logs for the critical "Flagged" entry written at startup by the compromise-detection mechanism in fixed releases; its presence indicates known unauthorized configuration changes and requires immediate investigation.
- Review RouterOS logs for the entries 'login failure for user -2 from <ip> via ssh' or 'user <name> added by ssh:-2@<ip>', and audit for the presence of a highly privileged user named 'ops', all confirmed indicators of active MikroTrick exploitation per CERT Polska.
Remediation
Additional hardening
- Upgrade RouterOS to 6.49.21 (v6 long-term), 7.23.4 (v7 long-term), or 7.24.2 (v7 stable); these releases contain the fix and add the startup compromise-detection scan that sets the "Flagged" marker.
- Restrict network access to the btest service using RouterOS firewall rules so only explicitly trusted IP addresses or management VPN peers can reach it, reducing the attack surface regardless of patch status.
- After upgrading, run '/system/device-mode/print' to check the flagged marker, then audit the configuration for unknown users, scripts, scheduler tasks, proxy servers, and tunnels that may indicate prior compromise.
- If the device is flagged or shows compromise indicators, treat it as fully taken over: isolate it from the network, preserve logs for forensic review, and rebuild from a known-good configuration rather than attempting in-place remediation.
Key dates
References
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
- https://mikrotik.com/supportsec/september-2026-vulnerability/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-67277
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
- https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
- https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
Frequently asked questions
Does CVE-2026-67277 affect my FedRAMP authorization?
If MikroTik RouterOS runs inside your authorization boundary, CVE-2026-67277 is a direct concern. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its September 13, 2026 remediation deadline has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency. Your path forward is either remediation now or formal documentation of the mitigation and the delay.
How does Knox help me handle CVE-2026-67277?
Knox does not patch MikroTik RouterOS on your behalf. Under the FedRAMP shared-responsibility model, remediating that vulnerability is your obligation. What Knox provides is the pre-authorized, single-tenant boundary to carry out that remediation in, along with Knox's automated continuous monitoring platform and audit-artifact coverage to support your next assessment. Applying the fix is your work. Managing your compliance posture while you do it is not something you have to handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance gaps, including cases like CVE-2026-67277. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the earliest possible window to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-67277's remediation deadline of September 13, 2026 has passed. What happens now?
An unremediated CVE-2026-67277 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing out the finding now and documenting the circumstances of the delay is what keeps your authorization standing and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
