Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-67277 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-10 |
| Vendor | MikroTik |
| Product | RouterOS |
| CVSS Score | 8.2 (high) |
| EPSS Score | 0.9% (percentile: 57%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-13 |
Vulnerability Description
Source: CISA KEV
MikroTik RouterOS contains a missing authentication for critical function vulnerability in the btest service.
There are two consequences. The first is kernel memory disclosure — a leak of data that should never leave kernel space. The second is denial of service, interrupting the device’s operation.
Kernel memory leaks are often underrated because they do not by themselves grant code execution. In practice they are raw material for a follow-up attack: they reveal addresses and structures that are supposed to be unpredictable, defeating protections that rely on memory layout randomisation.
btest is a bandwidth test service — a diagnostic tool that is often enabled “just for commissioning” and then left on permanently. It is worth checking whether it is active, independently of applying the update.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-13 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running MikroTik devices with RouterOS.
Beyond the firmware update, check whether the btest service is needed on production devices at all. Diagnostic services left exposed on a public interface are a classic deployment leftover — disabling them shrinks the attack surface regardless of this particular vulnerability.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
