MikroTik RouterOS: 1 CVE, Medium 4.9
Summary
CISA reports 1 vulnerability in MikroTik RouterOS. Weakness type: Insufficient Session Expiration. Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all associated traffic. Highest CVSS v3 score: 4.9 (Medium), exploitable over the network.
At a glance
- Vendor
- MikroTik
- Products
- RouterOS
- CVEs
- CVE-2026-14227
- Highest CVSS v3
- 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Information Technology
- Deployed
- Worldwide
- Vendor HQ
- Latvia
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-14227 | Insufficient Session Expiration | 4.9 | – | No | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information. |
Affected products (1)
- MikroTik RouterOS: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: MikroTik recommends administrators to ensure that when a user's permissions are downgraded, the affected user is fully logged out so the new policy can take effect.
- Mitigation: For more information, contact MikroTik (https://mikrotik.com/support). link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.