CVE Intelligence
Analysis AI-assisted

CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function (btest)

CVE-2026-67277 affects MikroTik RouterOS and allows an unauthenticated client to reach the btest test function before the primary session is authenticated, per the CERT-PL record. CISA lists the CVE in its Known Exploited Vulnerabilities catalog, and the record notes a packet-size flaw that can restart the kernel. Fixed releases are listed for each maintained branch.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-67277 is a missing authentication issue (CWE-306) in MikroTik RouterOS, involving the btest bandwidth test function. According to the CERT-PL record, RouterOS accepts a related btest connection before the corresponding primary session has finished authenticating, which lets an unauthenticated client start an IPv4 UDP test.

Impact

  • Availability: the record states that a separate packet-size validation flaw can cause an unsigned integer underflow, abnormally large fragmented output and a restart of the RouterOS kernel. NVD's vector rates the availability impact as high.
  • Confidentiality: the record states that, with random-data set to false, the sender can transmit an uninitialized tail from a kernel packet buffer. NVD's vector rates the confidentiality impact as low.
  • Integrity: NVD's vector rates the integrity impact as none.

Affected products and versions

  • The record lists affected ranges for Mikrotik RouterOS: from 6.0 up to before 6.49.21, from 7.0 up to before 7.23.4, and from 7.24 up to before 7.24.2.
  • Fixed releases named in the record are 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable).
  • The record does not state whether releases outside these ranges were tested.

Exploitation status

  • CISA lists CVE-2026-67277 in the Known Exploited Vulnerabilities catalog, with a date added of 2026-09-10 and a due date of 2026-09-13. This means exploitation in the wild is confirmed by CISA.
  • The CERT-PL post title also refers to the vulnerabilities as actively exploited.
  • Ransomware use is recorded as Unknown.
  • The EPSS entry shows a probability of 0.0156 and a percentile of 0.75058, dated 2026-10-23.

Remediation and mitigation

  • Update RouterOS to 6.49.21, 7.23.4 or 7.24.2, depending on the branch in use, as described in the MikroTik advisory and release notes.
  • Follow the CERT-PL mitigation guidance and the vendor instructions.
  • Until the update is applied, limit access to the router management plane and test services to trusted networks, and disable the btest service if it is not needed.
  • Organizations should evaluate how exposed each device is to the internet, as the CISA entry asks.

Detection guidance

  • Inventory all MikroTik RouterOS devices and record their versions and whether btest is enabled or reachable from untrusted networks.
  • Review logs and traffic for unexpected btest or UDP test activity from external sources.
  • Treat unplanned router reboots or crashes as possible signs of this issue and investigate them.
  • The record does not provide indicators of compromise.

Limitations of the available information

  • The record gives a high-level technical description and does not explain the exact trigger conditions or byte-level behavior, which this portal does not reproduce.
  • No indicators of compromise or details of observed campaigns are included in the sources consulted.
  • The record does not confirm whether versions outside the listed ranges are affected.
  • Scores differ between sources: NVD assigns 8.2 and CERT-PL assigns 8.8.
  • Ransomware association is unknown.

Frequently asked questions

What is CVE-2026-67277?

It is a missing authentication issue (CWE-306) in MikroTik RouterOS that affects the btest function, which can let an unauthenticated client start a test before the primary session is authenticated.

Is this vulnerability being exploited?

Yes, according to CISA, which lists CVE-2026-67277 in its Known Exploited Vulnerabilities catalog. The record marks ransomware use as unknown.

Which versions are fixed?

The record names 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable) as fixed releases. Administrators should update the branch they run.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.