Skip to content
Sign in

Mikrotik product

RouterOS

Alert
No CISA KEV deadline is open. CISA last added a RouterOS CVE on 25 Sep.

Tracked since 1 Aug · latest article 29 Sep · RSS · API

0Open KEV deadlines

None open

3Added to KEV · 90 days

of 5 in the full CISA catalogue · all time

1High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date5

RouterOS CVEs in CISA KEV with their federal deadlines. None is open.

Exploited RouterOS CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-67279RouterOS25 SepPassed 28 Sep6
In CISA KEVCVE-2026-67277RouterOS10 SepPassed 13 Sep3
In CISA KEVCVE-2026-86060RouterOS10 SepPassed 13 Sep8
In CISA KEVCVE-2018-7445RouterOS8 SepPassed 29 Sep–
In CISA KEVCVE-2018-14847RouterOS1 DecPassed 1 Jun–
Vendor CSV of 5 entries for MikrotikAll 5 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds RouterOS CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’263Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20263
Q4 20260

Fix listed

7 of 8 CVEs in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-86060: 93.7th percentile, in CISA KEVCVE-2026-67279: 83.1th percentile, in CISA KEVCVE-2026-67277: 75.2th percentile, in CISA KEVCVE-2026-67276: 95.2th percentileCVE-2026-84411: 58.5th percentileCVE-2026-67281: 54.1th percentileCVE-2026-16347: 32.9th percentileCVE-2026-67278: 17.9th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-6727695.2
CVE-2026-8606093.7
CVE-2026-6727983.1
CVE-2026-6727775.2
CVE-2026-8441158.5
CVE-2026-6728154.1
CVE-2026-1634732.9
CVE-2026-6727817.9

Coverage13 articles · all time

The latest 13 articles naming RouterOS, in the shared story grammar.

Full timeline
Quiet for 4 weekslast report 29 Sep13 articles5 outlets

13 articles from 5 outlets since 1 Aug. Quiet since 29 Sep.

Now1 Aug6 Sep10131619222528First reportSecurityOnline · 1 Aug, 02:11CISA alert10 Sep, 21:32 · official
  • Sat 1 Aug, 02:11 UTC. SecurityOnline, first report. MikroTik routers hit by critical CVE-2026-16347 bruteforce flaw.
  • Sun 6 Sep, 14:36 UTC. Security Affairs, its first report on the story. MikroTik RouterOS Zero Day Chain Gives Attackers Admin Control.
  • Mon 7 Sep, 05:06 UTC. SecurityOnline. MikroTik RouterOS Attacks Exploit MikroTrick Flaws for Full Control.
  • Tue 8 Sep, 11:01 UTC. Malwarebytes, its first report on the story. MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks.
  • Tue 8 Sep, 11:31 UTC. SecurityWeek, its first report on the story. MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain.
  • Thu 10 Sep, 21:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical MikroTik RouterOS Flaw. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 21:32 UTC. CISA. CISA Flags Actively Exploited MikroTik RouterOS Flaw Exposing Kernels. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 19:38 UTC. Security Affairs. MikroTik Routers Hacked Using Dual Flaws to Bypass Passwords. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 16:01 UTC. CISA. Actively Exploited MikroTik RouterOS Flaw Enables Unauthenticated Attacks. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 17:00 UTC. CISA. CISA Flags Actively Exploited SharePoint and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 21:31 UTC. Security Affairs. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 20:49 UTC. SecurityOnline. CISA Warns of Critical Unauthenticated RCE in MikroTik RouterOS.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Sat 1 AugDay 01
    1. MikroTik routers hit by critical CVE-2026-16347 bruteforce flaw02:11 · SecurityOnline · First report

  2. Quiet for 5 weeks

    Sun 6 SepDay 361
    1. MikroTik RouterOS Zero Day Chain Gives Attackers Admin Control14:36 · Security Affairs · Picked up again
  3. Mon 7 SepDay 371
    1. MikroTik RouterOS Attacks Exploit MikroTrick Flaws for Full Control05:06 · SecurityOnline
  4. Tue 8 SepDay 382
    1. MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks11:01 · Malwarebytes
    2. MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain11:31 · SecurityWeek

  5. Quiet for 2 days

    Thu 10 SepDay 402
    1. CISA Flags Actively Exploited Critical MikroTik RouterOS Flaw21:32 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA Flags Actively Exploited MikroTik RouterOS Flaw Exposing Kernels21:32 · CISA · official · Known exploited CVE

  6. Quiet for 3 days

    Mon 14 SepDay 441
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Picked up again · Known exploited CVE

  7. Quiet for 11 days

    Thu 24 SepDay 541
    1. MikroTik Routers Hacked Using Dual Flaws to Bypass Passwords19:38 · Security Affairs · Picked up again · Known exploited CVE
  8. Fri 25 SepDay 553
    1. Actively Exploited MikroTik RouterOS Flaw Enables Unauthenticated Attacks16:01 · CISA · official · Known exploited CVE
    2. CISA Flags Actively Exploited SharePoint and MikroTik Flaws17:00 · CISA · official · Known exploited CVE
    3. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw21:31 · Security Affairs · Known exploited CVE

  9. Quiet for 4 days

    Tue 29 SepDay 591
    1. CISA Warns of Critical Unauthenticated RCE in MikroTik RouterOS20:49 · SecurityOnline · Picked up again

All CVEs in coverage8

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-86060Exploited

    MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

    9.2Critical6.4% EPSS · 8 articles
  • CVE-2026-67279Exploited

    Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

    6.9Medium2.3% EPSS · 6 articles
  • CVE-2026-67277Exploited

    MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

    8.8High1.6% EPSS · 3 articles
  • CVE-2026-67276

    Mikrotik RouterOS vulnerability

    9.2Critical8.9% EPSS · 5 articles
  • CVE-2026-84411

    MikroTik RouterOS Integer Underflow

    9.8Critical0.9% EPSS · 1 article
  • CVE-2026-67281

    Mikrotik RouterOS vulnerability

    8.7High0.7% EPSS · 2 articles
  • CVE-2026-16347

    Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router

    8.8High0.4% EPSS · 1 article
  • CVE-2026-67278

    Mikrotik RouterOS vulnerability

    6.3Medium0.3% EPSS · 2 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in