Mikrotik Routeros
102 CVEs affecting Mikrotik Routeros. Latest disclosed: 2026-10-19. Critical: 8, High: 36.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84411 | Critical | 9.8 | 2026-10-02 | The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authenticatio… |
CVE-2026-86060 | Critical | 9.8 | 2026-09-05 | RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS… |
CVE-2017-20149 | Critical | 9.8 | 2022-10-15 | The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated u… |
CVE-2022-34960 | Critical | 9.8 | 2022-08-25 | The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hos… |
CVE-2018-7445 | Critical | 9.8 | 2018-03-19 | A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service… |
CVE-2026-67278 | Critical | 9.1 | 2026-09-05 | MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentic… |
CVE-2023-30799 | Critical | 9.1 | 2023-07-19 | MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can esc… |
CVE-2018-14847 | Critical | 9.1 | 2018-08-02 | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due… |
CVE-2026-103903 | High | 8.8 | 2026-10-12 | An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a l… |
CVE-2026-16347 | High | 8.8 | 2026-07-28 | MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not… |
CVE-2025-10948 | High | 8.8 | 2025-09-25 | A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson… |
CVE-2022-45313 | High | 8.8 | 2022-12-05 | Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arb… |
CVE-2019-3976 | High | 8.8 | 2019-10-29 | RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name fie… |
CVE-2018-1156 | High | 8.8 | 2018-08-23 | Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically… |
CVE-2026-67277 | High | 8.2 | 2026-09-05 | RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this sta… |
CVE-2026-67276 | High | 8.1 | 2026-09-05 | RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus… |
CVE-2021-41987 | High | 8.1 | 2022-03-16 | In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The atta… |
CVE-2021-27221 | High | 8.1 | 2021-03-19 | MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position… |
CVE-2019-3943 | High | 8.1 | 2019-04-10 | MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote d… |
CVE-2018-10066 | High | 8.1 | 2018-04-13 | An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of interc… |