CVE-2026-67277: MikroTik RouterOS Missing Authentication Flaw Added to CISA KEV

TL;DR

CISA added CVE-2026-67277, a missing authentication for critical function vulnerability in MikroTik RouterOS's btest service, to the Known Exploited Vulnerabilities catalog on 2026-09-10 with a federal remediation due date of 2026-09-13. The flaw is network-reachable, requires no privileges or user interaction, and results in kernel memory disclosure and denial of service in the btest service. If you run RouterOS, inventory every instance today, confirm btest exposure, and upgrade to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) per vendor guidance.

What this is

CVE-2026-67277 is a missing authentication for critical function vulnerability (CWE-306) in MikroTik RouterOS. The affected component is the btest service. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-10, with a federal remediation due date of 2026-09-13. Known ransomware use is listed as Unknown. CVSS is 8.8 HIGH (CNA: cvd@cert.pl, CVSS 4.0) and 8.2 HIGH (NVD, CVSS 3.1). EPSS is 0.00869, at the 0.57059 percentile.

Why it matters

KEV status means confirmed exploitation in the wild, and it carries a binding remediation due date for federal agencies. The CVSS scores confirm network-reachable, no-privilege, no-interaction exploitation with high availability impact. The EPSS score is a low near-term probability forecast, but it does not override KEV: EPSS is a forecasting input, not a substitute for confirmed exploitation. Treat CVE-2026-67277 as exploited and prioritize it above non-KEV work.

How it works

Per the official summary, RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With random-data=false, the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. The net effect is kernel memory disclosure and denial of service in the btest service.

This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

Detection and response

Hypothesis: a RouterOS instance with the btest service reachable from an untrusted network is running a version below 6.49.21, 7.23.4, or 7.24.2 and is therefore exposed to CVE-2026-67277.

Evidence that confirms or rejects it: the running firmware version on each device, the reachability of btest from untrusted networks, and the presence of anomalous kernel restarts or unexpected UDP test traffic. A version match against the fixed releases, or an advisory match against the MikroTik security advisory, confirms exposure; a version at or above the fixed releases with btest unreachable from untrusted networks rejects it.

What to do

1. Inventory. Enumerate every MikroTik RouterOS instance across your estate — edge routers, branch CPE, lab gear, and cloud-hosted appliances. Record version, management plane exposure, and whether btest is reachable.
2. Assess exposure. Determine which instances are internet-facing or reachable from untrusted segments. Per CISA guidance, stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines.
3. Patch or mitigate. Upgrade to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) in accordance with vendor instructions. If you cannot patch immediately, restrict access to the btest service and management interfaces to trusted networks only. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
4. Apply BOD 26-04 and forensics triage requirements. Align remediation with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and the associated Forensics Triage Requirements implementation guidance (links below).
5. Verify. After upgrading, confirm the running firmware version on each device, re-test reachability of btest from untrusted networks, and validate that no anomalous kernel restarts or unexpected UDP test traffic persist.
6. Close the ticket. Document the version applied, the exposure assessment, and the verification evidence. Retain records to demonstrate compliance with the 2026-09-13 due date.

FAQ

Is CVE-2026-67277 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-10, indicating confirmed exploitation in the wild.

What is the CISA due date for CVE-2026-67277? The federal remediation due date is 2026-09-13. Organizations outside the federal scope should treat this as a strong prioritization signal and patch on the same timeline where feasible.

Is this vulnerability internet-facing? The flaw is network-reachable (CVSS AV:N) and requires no privileges or user interaction. Any RouterOS instance with the btest service exposed to untrusted networks should be considered at risk. Evaluate each asset's internet exposure as part of your BOD 26-04 obligations.

Is there a known ransomware tie? CISA lists known ransomware use as Unknown for this CVE. Absence of a confirmed ransomware association does not reduce urgency given KEV status.

Which RouterOS versions fix CVE-2026-67277? The issue was fixed in 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). Upgrade to one of these or a later release per vendor instructions.

What is the CVSS score and EPSS score? CVSS is 8.8 HIGH (CNA, CVSS 4.0) and 8.2 HIGH (NVD, CVSS 3.1). EPSS is 0.00869, at the 0.57059 percentile. KEV status is the dominant signal here.

Sources

• MikroTik security advisory — September 2026 vulnerability
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-67277