MikroTik
Number 733 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: MikroTik, Mikrotik
Total vulnerabilities
30
Critical
6
High
14
Known Exploited
5
Exploit available
12
Visible in Bangladesh
154,490
Services seen by internet scanning
Network, no login needed
64.3%
Of 28 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 19 | 3 | 9 | 7 | 0 | 0 |
| 2025 | 3 | 0 | 2 | 1 | 0 | 0 |
| 2024 | 2 | 0 | 2 | 0 | 0 | 0 |
| 2023 | 2 | 1 | 1 | 0 | 0 | 0 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 1 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 1 | 0 | 0 | 0 | 0 | 1 |
| 2018 | 2 | 2 | 0 | 0 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| RouterOS | 28 | 19 |
| RouterOS-TFTP | 1 | 1 |
| WinBox | 1 | 0 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 8 | 6 |
| Path Traversal | 4 | 2 |
| Improper verification of cryptographic signature | 2 | 1 |
| Authentication Issues | 1 | 1 |
| Improper Access Control | 1 | 1 |
| Improper Input Validation | 1 | 0 |
| Improper Validation of Specified Quantity in Input | 1 | 1 |
| Improper certificate validation | 1 | 0 |
| Improper enforcement of behavioral workflow | 1 | 0 |
| Improper neutralization of argument delimiters in a command ('argument injection') | 1 | 1 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-86060 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Critical | 6.4% | |
| CVE-2026-67279 | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Medium | 2.3% | |
| CVE-2026-67277 | Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | High | 1.6% | |
| CVE-2018-14847 | MikroTik Router OS Directory Traversal Vulnerability | Critical | 96.0% | |
| CVE-2018-7445 | MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | Critical | 65.8% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-89035 | MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass | High | 0.3% | |
| CVE-2026-112158 | MikroTik RouterOS ipt_SAME.ko same_check integer overflow | Medium | 0.3% | |
| CVE-2026-103903 | MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation | High | 0.4% | |
| CVE-2026-84411 | MikroTik RouterOS Integer Underflow | Critical | 0.9% | |
| CVE-2026-93345 | MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI | High | 0.5% | |
| CVE-2026-89028 | MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX | High | 0.6% | |
| CVE-2026-56719 | MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX | Medium | 0.4% | |
| CVE-2026-89021 | MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction | Medium | 0.4% | |
| CVE-2026-89020 | MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation | High | 0.6% | |
| CVE-2026-86060 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Critical | 6.4% |