VulnSocial

CVE-2026-14227Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-613

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-30); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-30: 1Mentions · 2026-07-31: 1Patch / Workaround · 2026-07-31: 1Technical Details · 2026-07-30: 1Technical Details · 2026-07-31: 107-3007-31
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-301
Disclosure1
2026-07-311
Patch1
Full discourse2 posts
  • connect24h@connect24h
    Patch

    勘弁してほしい。VPNの秘密鍵が平文で抜ける。 CVE-2026-14227（CVSS 4.9）は、APIを有効化したMikroTik RouterOSの全versionが対象。権限を下げても既存sessionが旧権限を保持し、WireGuard private keyへ届く。CISAはVPN impersonationと関連trafficの復号につながると評価している。現場ではCVSSより漏れる物を見るべき案件だ。 自分ならまず「/user active print」で残存sessionを洗い、対象userをfull logout。APIをtrusted networkに絞り、悪用を否定できなければWireGuard interfaceを再作成して鍵をrotateし、全peerのpublic keyを更新する。先送りしないでほしい。 #セキュリティ ソース: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01

    Post summary

    The advisory explains that CVE-2026-14227 allows plaintext exposure of WireGuard private keys on MikroTik RouterOS with API enabled and recommends containment measures such as session cleanup, API confinement, and key rotation, noting CISA’s assessment of VPN impersonation risk.

    023162236.0K
    8.4K followersView on X
  • Windows Forum@windowsforum
    Disclosure

    🔐 RouterOS can keep old API permissions alive after a downgrade or timeout. Not a full takeover, but “revoke access” shouldn’t mean “maybe after they log out”—especially on critical routers. https://windowsforum.com/security-alerts.84/cve-2026-14227-log-out-routeros-api-users-after-downgrades.440962/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #Cisa #ApiSecurity #MikrotikRouteros #Cve202614227 https://t.co/GhRRFHy5Mk

    Post summary

    The post highlights that RouterOS keeps API permissions alive after downgrades or timeouts, posing a risk to critical routers, but no PoC, exploit, patch, or active exploitation details are provided.

    0000055
    1.3K followersView on X

Explore more

Back to dashboard