TI-2026-47574 Aliases CVE-2026-67277 GHSA-6q2x-6fhj-r3w8

Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

CRITICAL 95Exploited in the wildCWE-306Published 2026-09-05 · Updated 2026-09-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Why it matters now

Exploitation Active In CISA KEV since 2026-09-10CISA due date 2026-09-13

EPSS 0.0156 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed RouterOS (Mikrotik): 7.24.2, 7.23.4, 6.49.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MikroTik	RouterOS	7.24 to before 7.24.2; 7.0.0 to before 7.23.4; 6.0.0 to before 6.49.21	7.24.2, 7.23.4, 6.49.21	Patch available	CNA

RouterOS VendorMikroTik Affected 7.24 to before 7.24.2; 7.0.0 to before 7.23.4; 6.0.0 to before 6.49.21 Fixed in 7.24.2, 7.23.4, 6.49.21 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:mikrotik:routeros::::::::	6.0 to before 6.49.21; 7.0 to before 7.23.4; 7.24 to before 7.24.2	Vulnerable	MikroTik

cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* Versions 6.0 to before 6.49.21; 7.0 to before 7.23.4; 7.24 to before 7.24.2 Vulnerable ·MikroTik

Remediation

Fix · CNA RouterOS (Mikrotik) Fixed in 7.24.2, 7.23.4, 6.49.21

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-09-05
Mikrotik RouterOS — mikrotik.com/supportsec/september-2026-vulnerability
6 records Highest priority Priority CRITICAL 3 CRITICAL, 1 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-58872 SSH session privilege manipulation via a crafted username in Mikrotik RouterOSPriority CRITICAL 99
- TI-2026-47576 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSPriority CRITICAL 88
- TI-2026-47577 Unauthenticated file read in Mikrotik RouterOSPriority HIGH 77
Show all 6 records → Advisory →

Timeline

2026-09-10 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2026-67277
2026-10-03 Alias added: GHSA-6q2x-6fhj-r3w8

References

Exploit 1

https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Advisory 3

Other 3

TI-2018-05369 A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS… KEVCVSS 3.1CRITICAL 9.8
TI-2026-58872 SSH session privilege manipulation via a crafted username in Mikrotik RouterOS KEVCVSS 4.0CRITICAL 9.2
TI-2018-10669 MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary… KEVCVSS 3.1CRITICAL 9.1
TI-2026-47576 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS KEVCVSS 4.0MEDIUM 6.9
TI-2022-22302 Out-of-bounds read in MicroTik RouterOS CVSS 3.1CRITICAL 9.8
TI-2017-14215 The Mikrotik RouterOS web server allows memory corruption in releases before Stable… CVSS 3.1CRITICAL 9.8

See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences