What is CVE-2026-93345?

CVE-2026-93345 is a high-severity vulnerability in Mikrotik Routeros, classified under Improper Validation of Specified Quantity in Input. CVSS score: 7.5/10. Published 2026-09-22.

How severe is CVE-2026-93345?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Mikrotik Routeros

CVE-2026-93345

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. Attackers can repeatedly send a single BGP UPDATE packet carrying a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length to indefinitely hold down the BGP plane, causing session termination without a NOTIFICATION and triggering a service malfunction on the device.

Published 2026-09-22 · last modified 2026-09-22.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Mikrotik Routeros

Weakness classification (CWE)

CWE-1284 — Improper Validation of Specified Quantity in Input

References

forum.mikrotik.com/t/7-25beta-development-is-released/272788 (release-notes, patch)
www.vulncheck.com/advisories/mikrotik-routeros-improper-input-validation-dos-vi… (third-party-advisory)

Frequently asked questions

What is CVE-2026-93345?: CVE-2026-93345 is a high-severity vulnerability in Mikrotik Routeros, classified under Improper Validation of Specified Quantity in Input. CVSS score: 7.5/10. Published 2026-09-22.
How severe is CVE-2026-93345?: High severity. CVSS v3 base score is 7.5 out of 10.