CVE-2026-67281Disclosure(mikrotik / routeros)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch mikrotik routeros systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

mikrotik CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-22CWE-824

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

routeros

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
6 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 5d ago at 1 mentions (2026-09-05); latest day: 1
6 total mentions across 6 days

Affected systems

Vendors

mikrotik

Products

routeros

Deep dive

Activity timeline6 mentions / 6d

Signal classification4 categories

Disclosure

350.0%

Exploit

116.7%

General

116.7%

Patch

116.7%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-05	1	Disclosure1
2026-09-06	1	Disclosure1
2026-09-07	1	Disclosure1
2026-09-08	1	Exploit1
2026-09-09	1	General1
2026-09-27	1	Patch1

Full discourse6 posts

YogSotho@YogSoth043d
Exploit
🧨🧨🧨 MIKROTRICK 🧨🧨🧨 Weaponized MikroTik RouterOS exploitation framework. - CVE-2026-67279 - CVE-2026-86060 - CVE-2026-67276 - CVE-2026-67281 - CVE-2026-67277 - CVE-2026-67278 - CVE-2025-61481 - CVE-2025-10948 - CVE-2018-14847 Now available at my beloved ❤️ https://gibliz.taile5d4a8.ts.net/0days/ #exploit #rce #vulnerabilities #cve #0days #mikrotik #router #cybersecurity #infosec #antisec #linux
Post summary
The post promotes a weaponized MikroTik RouterOS exploitation framework with a link to code for several CVEs, but it provides no evidence of active exploitation, patches, or detailed vulnerability specifics.
720277765.2K
2.0K followersView on X
DMNTR Network Solutions 👻 AS204773@weareDMNTRs44d
Disclosure
- CVE-2026-86060 — Escalada de privilegios vía manejo de argumentos en el proceso de login SSH (sesión SSH no autenticada). - CVE-2026-67281 — Lectura de ficheros sin autenticación en WebFig (/jsproxy), con posible exposición de ficheros de configuración y credenciales. - CVE-2026-67279 — Ejecución de peticiones exec por SSH sin autenticación previa, permitiendo creación y sobrescritura de ficheros gestionados por RouterOS. - CVE-2026-67278 — Aceptación de firmas RSA/PKCS#1 v1.5 malformadas en la validación X.509, habilitando suplantación de servidores TLS. - CVE-2026-67277 — Sesiones btest "related" sin autenticación completada, con fuga de memoria de buffers de kernel y posible reinicio del equipo (denegación de servicio). - CVE-2026-67276 — Comparación incompleta de clave pública RSA en autenticación SSH, permitiendo autenticarse como un usuario autorizado sin disponer de su clave privada.
Post summary
Multiple new CVEs are disclosed, detailing various unauthenticated or privileged vulnerabilities, but no exploitation evidence, PoC, or patch information is provided.
513061124.7K
25.9K followersView on X
Sijisu@sijsu24d
Patch
Update your MikroTik RouterOS again, to at least 7.24.3 Just published a blog on how you could turn the Webfig "file-read" CVE-2026-67281 (already published by @CERT_Polska_en) into a delayed RCE and on *two other RCEs* in DHCP relay and Webfig. More: https://sijisu.eu/posts/3-mikrotik-preauth-rces/
Post summary
The post primarily urges users to update MikroTik RouterOS to version 7.24.3, referencing a blog that details multiple pre-authentication RCE vulnerabilities including CVE-2026-67281.
01091294
211 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal point… https://www.cve.org/CVERecord?id=CVE-2026-67281
Post summary
The text announces CVE‑2026‑67281, describing an unauthenticated file‑read vulnerability in RouterOS WebFig’s /jsproxy endpoint, but provides no PoC, exploit, or patch information.
020201.7K
58.1K followersView on X
Reelix@Reelix42d
General
@YogSoth0 Whilst hunting for a PoC for CVE-2026-67281 for an assessment I'm currently on, I come across this. I could attempt to brute-force the rather visible auth section on your site, but after your recent misadventures, I don't want to give you another headache. The hunt continues :)
Post summary
The tweet indicates the author is searching for a Proof of Concept for CVE-2026-67281 but provides no concrete details, patches, or exploitation evidence.
10010199
505 followersView on X
ADK Cyber@ADKCyber45d
Disclosure
MikroTik RouterOS WebFig has a high-severity unauthenticated file-read flaw (CVE-2026-67281, CVSS 8.7). Review patches if these routers are in use. https://nvd.nist.gov/vuln/detail/CVE-2026-67… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/msphVmGwhe
Post summary
The tweet announces the high‑severity, unauthenticated file‑read flaw CVE‑2026‑67281 in MikroTik RouterOS WebFig, recommends reviewing patches, and provides basic technical details.
0000062
93 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	mikrotik	routeros	-	-	-

Explore more

Back to dashboard mikrotik CVEs routeros vulnerabilities

What researchers are saying

CVE-2026-67281

YogSotho[verified]@YogSoth0Exploit

The post promotes a weaponized MikroTik RouterOS exploitation framework with a link to code for several CVEs, but it provides no evidence of active exploitation, patches, or detailed vulnerability specifics.

DMNTR Network Solutions 👻 AS204773[verified]@weareDMNTRsDisclosure

Multiple new CVEs are disclosed, detailing various unauthenticated or privileged vulnerabilities, but no exploitation evidence, PoC, or patch information is provided.

ADK Cyber[verified]@ADKCyberDisclosure

The tweet announces the high‑severity, unauthenticated file‑read flaw CVE‑2026‑67281 in MikroTik RouterOS WebFig, recommends reviewing patches, and provides basic technical details.

Sijisu@sijsuPatch

The post primarily urges users to update MikroTik RouterOS to version 7.24.3, referencing a blog that details multiple pre-authentication RCE vulnerabilities including CVE-2026-67281.

CVE@CVEnewDisclosure

The text announces CVE‑2026‑67281, describing an unauthenticated file‑read vulnerability in RouterOS WebFig’s /jsproxy endpoint, but provides no PoC, exploit, or patch information.

Reelix@ReelixGeneral

The tweet indicates the author is searching for a Proof of Concept for CVE-2026-67281 but provides no concrete details, patches, or exploitation evidence.