CVE-2026-67277 · High · CISA KEV

MikroTik RouterOS Kernel Memory Disclosure & DoS via Missing Authentication (KEV)

Threat Engine Auto-Feed · data current as of 2026-09-11

A critical missing authentication vulnerability in MikroTik RouterOS's btest service allows for kernel memory disclosure and denial of service. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, indicating a high exploitation pressure. Organizations using MikroTik RouterOS are at risk of significant operational disruption and sensitive information exposure.

  • CVSS:
  • EPSS percentile: 0.52789
  • Exploitation pressure: 57/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 53th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from a critical function within MikroTik RouterOS's btest service that lacks proper authentication. This means an attacker can interact with this service without needing to prove their identity, bypassing security controls designed to restrict access to sensitive operations.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations heavily reliant on MikroTik RouterOS for network infrastructure
  • Financial services, Technology, and other sectors targeted by financially motivated or state-sponsored actors
  • Enterprises with exposed network devices

Misconfigurations that escalate it

  • RouterOS devices with btest service enabled and accessible without sufficient authentication
  • Lack of network segmentation isolating critical infrastructure devices

High-impact scenarios

  • Attackers gaining unauthorized access to kernel memory, potentially revealing sensitive configuration or operational data.
  • Denial of service against critical network routing infrastructure, leading to widespread operational outages.
  • Compromise of network perimeter devices, serving as a pivot point for further internal network penetration.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor MikroTik RouterOS devices for unusual activity related to the btest service.
  • Implement network intrusion detection systems (NIDS) to flag anomalous traffic patterns to and from RouterOS devices.
  • Regularly review RouterOS logs for unauthorized access attempts or service disruptions.

Contain

  • Isolate affected MikroTik RouterOS devices from critical network segments if immediate patching is not feasible.
  • Restrict network access to the btest service on RouterOS devices to only trusted management interfaces or IP addresses.

Patch

  • Apply the latest security updates and patches provided by MikroTik for RouterOS to address CVE-2026-67277.

Frontier verdict — High

High priority due to active exploitation in the wild (CISA KEV) and potential for kernel memory disclosure and denial of service on critical network infrastructure.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.