ZeusQA
Start free

Known exploited vulnerabilities

MikroTik vulnerabilities attackers have used

Every MikroTik vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 5 MikroTik vulnerabilities as exploited in the wild, 3 of them added in the last 12 months. The most recent is CVE-2026-67279, added Sep 25, 2026. RouterOS has the most entries (5).

In KEV, all time
5
Added, last 12 months
3
Used in ransomware
0
New CVEs this week
0

Every MikroTik entry in CISA KEV

  1. CVE-2026-67279

    Added · due

    Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

    Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve…

  2. CVE-2026-86060

    Added · due

    MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

    MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.

  3. CVE-2026-67277

    Added · due

    MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

    MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.

  4. CVE-2018-7445

    Added · due

    MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability

    In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.

  5. CVE-2018-14847

    Added · due

    MikroTik Router OS Directory Traversal Vulnerability

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works