CVE-2026-67281: Mikrotik Routeros path traversal (CVSS 7.5)

Description

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Mikrotik Routeros≥ 7.20 < 7.23.4 · ≥ 7.24 < 7.24.2

Remediation

Fixed in

Mikrotik Routeros≥ 7.23.4

Patch & vendor advisories

https://mikrotik.com/supportsec/september-2026-vulnerability/

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/MitigationThird Party Advisory
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-67281 being actively exploited?

CVE-2026-67281 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.73%.

How severe is CVE-2026-67281?

CVE-2026-67281 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.73% probability of exploitation.

Which products are affected by CVE-2026-67281?

Affected products include Mikrotik Routeros.

How do I fix CVE-2026-67281?

Upgrade affected software to a fixed version, for example Mikrotik Routeros 7.23.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-67281 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo