CVE-2018-14847Active Exploitation(mikrotik / routeros)

HIGHCVSS 9.1 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for mikrotik routeros systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

mikrotik CVEs Back to dashboard

7.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-06-01. Apply updates per vendor instructions.

Exploit / PoC references

Vendor / third-party advisories

https://mikrotik.com/supportsec/winbox-vulnerability

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847

Weakness type (CWE)

CWE-22

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

routeros

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Peaked 2d ago at 1 mentions (2026-09-08); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

mikrotik

Products

routeros

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Active Exploitation

266.7%

Exploit

133.3%

Referenced assets1 URL

By indicator

https://gibliz.taile5d4a8.ts.net/0days/

Classification over time

Date	Total	Labels

2026-09-08	1	Exploit1
2026-09-27	1	Active Exploitation1
2026-09-28	1	Active Exploitation1

Full discourse3 posts

YogSotho@YogSoth046d
Exploit
🧨🧨🧨 MIKROTRICK 🧨🧨🧨 Weaponized MikroTik RouterOS exploitation framework. - CVE-2026-67279 - CVE-2026-86060 - CVE-2026-67276 - CVE-2026-67281 - CVE-2026-67277 - CVE-2026-67278 - CVE-2025-61481 - CVE-2025-10948 - CVE-2018-14847 Now available at my beloved ❤️ https://gibliz.taile5d4a8.ts.net/0days/ #exploit #rce #vulnerabilities #cve #0days #mikrotik #router #cybersecurity #infosec #antisec #linux
Post summary
A weaponized MikroTik RouterOS exploitation framework is available via a provided link, referencing several recent CVEs, indicating that functional exploit code exists, though no active exploitation or patches are mentioned.
720277765.2K
2.0K followersView on X
General Intels Daily@intels_daily27d
Active Exploitation
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗔𝗰𝗰𝗲𝘀𝘀 𝘀𝗮𝗹𝗲 🏢 Target: 𝗜𝗿𝗮𝗾𝗶 𝗠𝗶𝗻𝗶𝘀𝘁𝗿𝘆 𝗼𝗳 𝗙𝗶𝗻𝗮𝗻𝗰𝗲, 𝗥𝗮𝘀𝗵𝗲𝗲𝗱 𝗕𝗮𝗻𝗸, 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗕𝗮𝗻𝗸 𝗼𝗳 𝗜𝗿𝗮𝗾 🧩 Products: 𝗠𝗶𝗸𝗿𝗼𝗧𝗶𝗸 𝗥𝗕𝟮𝟬𝟭𝟭𝗨𝗶𝗔𝗦, 𝗥𝗼𝘂𝘁𝗲𝗿𝗢𝗦 🛡️ CVE-2018-14847, CVE-2019-3924 Threat actor Blacknet00 claims to have compromised a MikroTik router belonging to the Iraqi Ministry of Finance. The post details multiple vulnerabilities (including CVE-2018-14847 and SNMP misconfigurations) and provides extensive internal network details, routing tables, and lists of connected financial entities, including Rasheed Bank and the Industrial Bank of Iraq. #AccessSale #InitialAccess #ThreatIntel #CTI
Post summary
Threat actor Blacknet00 claims to have compromised MikroTik routers belonging to Iraqi financial institutions (Ministry of Finance, Rasheed Bank, Industrial Bank of Iraq) exploiting CVE‑2018‑14847 and SNMP misconfigurations, and is selling the access.
00000150
764 followersView on X
General Intels Daily@intels_daily28d
Active Exploitation
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗔𝗰𝗰𝗲𝘀𝘀 𝘀𝗮𝗹𝗲 🏢 Target: 𝗕𝗮𝗻𝗴𝗹𝗮𝗱𝗲𝘀𝗵 𝗔𝗿𝗺𝘆 🧩 Product: 𝗠𝗶𝗸𝗿𝗼𝗧𝗶𝗸 𝗥𝗼𝘂𝘁𝗲𝗿𝗢𝗦 🛡️ CVE-2018-14847, CVE-2019-3976 A threat actor claims to have fully compromised the Bangladesh Army network, specifically targeting a MikroTik router at the Qadirabad Cantonment. The actor provides extensive technical details, including internal network maps, device lists, PPPoE connections, and backup files containing passwords, and offers this access for sale. #AccessSale #InitialAccess #ThreatIntel #CTI
Post summary
A threat actor advertises the sale of initial access to Bangladesh Army infrastructure, claiming successful exploitation of MikroTik routers via CVE-2018-14847 and CVE-2019-3976 and providing evidence such as network maps and credential backups.
00000175
765 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	mikrotik	routeros	-	-	-

Explore more

Back to dashboard mikrotik CVEs routeros vulnerabilities

What researchers are saying

CVE-2018-14847

YogSotho[verified]@YogSoth0Exploit

A weaponized MikroTik RouterOS exploitation framework is available via a provided link, referencing several recent CVEs, indicating that functional exploit code exists, though no active exploitation or patches are mentioned.

General Intels Daily[verified]@intels_dailyActive Exploitation

Threat actor Blacknet00 claims to have compromised MikroTik routers belonging to Iraqi financial institutions (Ministry of Finance, Rasheed Bank, Industrial Bank of Iraq) exploiting CVE‑2018‑14847 and SNMP misconfigurations, and is selling the access.

General Intels Daily[verified]@intels_dailyActive Exploitation

A threat actor advertises the sale of initial access to Bangladesh Army infrastructure, claiming successful exploitation of MikroTik routers via CVE-2018-14847 and CVE-2019-3976 and providing evidence such as network maps and credential backups.