Path Traversal in Mikrotik Routeros
CVE-2026-67281
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (53.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.007 · change: +0.003
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/en/posts/2026/09/mikrotik-routeros-cve (Third Party Advisory, third-party-advisory)
- cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploite… (technical-description, Third Party Advisory, Mitigation)
- forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 (release-notes)
- forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 (release-notes, Release Notes)
- forum.mikrotik.com/t/7-24-2-stable-is-released/272800 (release-notes, Release Notes)
- mikrotik.com/supportsec/september-2026-vulnerability/ (vendor-advisory, Vendor Advisory)
- npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-woul… (Exploit, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2026-67281?
- CVE-2026-67281 is a high-severity vulnerability in Mikrotik Routeros, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-09-05.
- How severe is CVE-2026-67281?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2026-67281 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.