MikroTik vulnerabilities and fixes

CVEs that mention MikroTik, ranked by priority. 5 tracked.

MikroTik has 5 tracked vulnerabilities, 1 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 4. Most recent: 2026-10-21. Highest priority: CVE-2026-86060 (score 96/100).

• CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
• CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
• CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
• CVE-2026-89035 HIGH 7.4 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that al
• CVE-2026-14227 MEDIUM 4.9 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insuffic

FAQ

How do I fix MikroTik vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is MikroTik being exploited right now?

Yes: 3 MikroTik CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which MikroTik CVE should I patch first?

CVE-2026-86060 currently ranks highest (96/100): MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability.

← Back to latest CVEs