CVE-2026-67277 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-05

Added to CISA KEV: 2026-09-10 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for anomalous btest/UDP activity, unexpected kernel restarts, and connectivity disruptions; verify device integrity and configuration.
Immediately upgrade RouterOS to a fixed release: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) or later.
Until patched, disable the btest (bandwidth-test) service and restrict management/service ports to trusted management networks; block btest ports at the firewall and disable public exposure of the WAN management plane.
Monitor for repeated btest connection attempts and unexpected device reboots; enforce firewall input rules to drop unsolicited traffic to service ports. Patch priority: URGENT / IMMEDIATE (CISA KEV, active exploitation).

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-67277 is a critical vulnerability in MikroTik RouterOS that stems from a missing authentication check for "btest" (bandwidth test) connections, allowing unauthenticated clients to interact with the service before a primary session is established. This flaw is significant because it enables an attacker to perform kernel memory disclosure and trigger a denial-of-service (DoS) condition, posing a substantial risk to network infrastructure. Because this vulnerability is actively exploited in the wild, it has been formally included in CISA's Known Exploited Vulnerabilities (KEV) Catalog.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog ^[6]^[7].
Attack Prerequisites: Exploitation is remote and does not require authentication or user interaction ^[2].
Mechanism: Attackers initiate a "related" btest connection to trigger an IPv4 UDP test. By manipulating the "random-data" and "packet-size" parameters, they can induce kernel memory leaks or exploit an unsigned integer underflow to crash the device ^[1]^[2].
Proof-of-Concept: While exploit details are documented, public weaponized exploit tools are often associated with active campaigns once a KEV listing occurs.

Affected Products & Patches

Affected Versions: MikroTik RouterOS versions prior to the fixed releases.
Patch Availability: MikroTik has released fixes in all support channels, specifically including versions 6.49.21 (Long-term) and 7.23.4 (Long-term) ^[4]^[5].
Mitigation: Administrators should immediately upgrade to the latest patched firmware releases provided by MikroTik. If patching is not immediately feasible, disabling the affected btest service is the primary recommended workaround.

Impact

System Access: Successful exploitation results in the unauthorized disclosure of sensitive kernel memory and enables denial-of-service (DoS) attacks, which can render the router unresponsive ^[3]^[4].
Business Risk: For internet-facing deployments, this vulnerability allows remote, unauthenticated attackers to disrupt critical network services, potentially leading to widespread connectivity loss and facilitating further reconnaissance through memory information leakage.

Sources

CVE-2026-67277 - Vulnerability Details - OpenCVE
RouterOS permits a "btest" connection from an unauthenticated client before the primary session is authenticated, allowing the attacker to initiate an IPv4 UDP test with "random-data=false". This causes the service to transmit an uninitialised tail from a kernel packet buffer, exposing kernel memory…
NVD-CVE-2026-67277
CVE-2026-67277 Detail Description RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a k…
CVE-2026-67277 | Vulnerability Details
Kernel memory disclosure and denial of service in MikroTik RouterOS. An unauthenticated client can use this state to start an IPv4 UDP test. transmits an ...
CVE Record: CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) ...
September 2026 vulnerability
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels.

🔴 CVE-2026-67277