| CVE-2026-89035 |
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows…
|
9.1
Critical
|
Oct 21, 2026 |
| CVE-2026-112158 |
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8
|
7.1
High
|
Oct 19, 2026 |
| CVE-2026-103903 |
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote…
|
8.7
High
|
Oct 12, 2026 |
| CVE-2026-84411 |
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling…
|
9.8
Critical
|
Oct 2, 2026 |
| CVE-2026-93345 |
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI…
|
8.7
High
|
Sep 22, 2026 |
| CVE-2026-89028 |
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows…
|
8.2
High
|
Sep 16, 2026 |
| CVE-2026-56719 |
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows…
|
6.3
Medium
|
Sep 16, 2026 |
| CVE-2026-89021 |
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image…
|
6.9
Medium
|
Sep 14, 2026 |
| CVE-2026-89020 |
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation
|
8.7
High
|
Sep 14, 2026 |
| CVE-2026-86060 |
Exploited
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
|
9.2
Critical
|
Sep 5, 2026 |
| CVE-2026-67281 |
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session…
|
8.7
High
|
Sep 5, 2026 |
| CVE-2026-67278 |
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509…
|
6.3
Medium
|
Sep 5, 2026 |
| CVE-2026-67279 |
Exploited
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
|
6.9
Medium
|
Sep 5, 2026 |
| CVE-2026-67277 |
Exploited
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
|
8.8
High
|
Sep 5, 2026 |
| CVE-2026-67276 |
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized…
|
9.2
Critical
|
Sep 5, 2026 |
| CVE-2026-14227 |
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient…
|
6.9
Medium
|
Jul 30, 2026 |
| CVE-2026-16347 |
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against…
|
8.8
High
|
Jul 28, 2026 |
| CVE-2025-42611 |
RouterOS provides various services that rely on correct verification of client and server certificates to secure…
|
6.5
Medium
|
May 5, 2026 |
| CVE-2026-7668 |
A vulnerability was identified in MikroTik RouterOS 6.49.8
|
6.9
Medium
|
May 2, 2026 |
| CVE-2025-10948 |
A vulnerability has been found in MikroTik RouterOS 7
|
8.7
High
|
Sep 25, 2025 |
| CVE-2025-6563 |
A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2
|
4.8
Medium
|
Jul 3, 2025 |
| CVE-2025-6443 |
Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability
|
7.2
High
|
Jun 25, 2025 |
| CVE-2023-32154 |
Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability
|
7.5
High
|
May 3, 2024 |
| CVE-2023-30800 |
The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue
|
7.5
High
|
Sep 7, 2023 |
| CVE-2023-30799 |
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue
|
9.1
Critical
|
Jul 19, 2023 |