M
Vendor security profile5 actively exploited CVEs
mikrotik
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs21
Critical2
CISA KEV5
Public exploit13
Patch rate%24
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
11
2
CVE KEV
CVE severity distribution
21toplam CVE
Critical2 (10%)
High9 (43%)
Medium8 (38%)
Uncertain2 (10%)
Patch and exploitation view
%24
Verified patch
%24
CISA KEV
%62
Public exploit
5Patch available
0Partial
3Workaround
0Vendor: no patch
13Unknown
Latest vulnerabilities
8.7
CVE-2026-103903
MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
M
Patch status unknown
9.8
CVE-2026-84411
MikroTik RouterOS Integer Underflow
M
Patch status unknownEPSS %1
8.7
CVE-2026-93345
MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
M
Patch verifiedEPSS %0
8.2
CVE-2026-89028
MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
M
Patch verifiedEPSS %1
6.3
CVE-2026-56719
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX
M
Patch verifiedEPSS %0
6.9
CVE-2026-89021
MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
M
Patch verifiedEPSS %0
5.3
CVE-2026-89020
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path
M
Patch verifiedEPSS %0
9.2
CVE-2026-86060 Actively exploited
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
M
Patch status unknownEPSS %6
6.9
CVE-2026-67279 Actively exploited
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
M
WorkaroundEPSS %1
6.3
CVE-2026-67278
TLS server impersonation possible in Mikrotik RouterOS
M
Patch status unknownEPSS %0