{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: MikroTik vulnerabilities","home_page_url":"https://patchfirst.co/vendor/mikrotik/","feed_url":"https://patchfirst.co/feed/vendor/mikrotik.json","description":"New and newly exploited MikroTik CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-84411","url":"https://patchfirst.co/cve/CVE-2026-84411/","title":"CVE-2026-84411: The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body…","content_text":"MikroTik · RouterOS. Not in CISA KEV. EPSS 0.9% (higher than 58.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 25.3 of 100.","summary":"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body…","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-06T15:15:48.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":25.3,"kev":null,"epss":{"score":0.00864,"percentile":0.58585},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-67279#kev","url":"https://patchfirst.co/cve/CVE-2026-67279/","title":"[KEV] CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1565.001 Stored Data Manipulation. Priority 74.2 of 100.","summary":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-26T04:17:47.000Z","tags":["kev","public-exploit","T1190","T1059","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.2,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.02277,"percentile":0.83093},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1059","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-86060#kev","url":"https://patchfirst.co/cve/CVE-2026-86060/","title":"[KEV] CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 6.4% (higher than 93.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 78.6 of 100.","summary":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:16.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.06392,"percentile":0.93659},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67277#kev","url":"https://patchfirst.co/cve/CVE-2026-67277/","title":"[KEV] CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 73.8 of 100.","summary":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:29.000Z","tags":["kev","public-exploit","T1190","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":73.8,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.0156,"percentile":0.75209},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67276","url":"https://patchfirst.co/cve/CVE-2026-67276/","title":"CVE-2026-67276: SSH user impersonation possible in Mikrotik RouterOS","content_text":"Mikrotik · RouterOS. Not in CISA KEV. ENISA EUVD lists it as exploited. EPSS 8.9% (higher than 95.2% of CVEs). CVSS 9.2 CRITICAL. Public exploit code exists. Priority 77.5 of 100.","summary":"SSH user impersonation possible in Mikrotik RouterOS","date_published":"2026-09-05T00:00:00.000Z","date_modified":"2026-09-09T04:26:19.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":77.5,"kev":null,"epss":{"score":0.08943,"percentile":0.95239},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"Mikrotik","product":"RouterOS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-30799","url":"https://patchfirst.co/cve/CVE-2023-30799/","title":"CVE-2023-30799: MikroTik RouterOS Administrator Privilege Escalation","content_text":"MikroTik · RouterOS. Not in CISA KEV. EPSS 1.4% (higher than 72.9% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 62.7 of 100.","summary":"MikroTik RouterOS Administrator Privilege Escalation","date_published":"2023-07-19T00:00:00.000Z","date_modified":"2025-11-21T16:13:26.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":62.7,"kev":null,"epss":{"score":0.01428,"percentile":0.72949},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-7445#kev","url":"https://patchfirst.co/cve/CVE-2018-7445/","title":"[KEV] CVE-2018-7445: MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2022-09-08. ENISA EUVD lists it as exploited. EPSS 65.8% (higher than 99.27% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.7 of 100.","summary":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2026-06-17T02:03:08.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2022-09-08","ransomware":false},"epss":{"score":0.65828,"percentile":0.99267},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-14847#kev","url":"https://patchfirst.co/cve/CVE-2018-14847/","title":"[KEV] CVE-2018-14847: MikroTik Router OS Directory Traversal Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 96.0% (higher than 99.87% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.3 of 100.","summary":"MikroTik Router OS Directory Traversal Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T01:41:44.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":69.3,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.95981,"percentile":0.99874},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}