MikroTik RouterOS Missing Authentication for Critical Function Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/09/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| RouterOS | Versions not published yet (product named by CISA KEV) | |
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free