Vendors › MikroTik

MikroTik security advisories

3 CISA ICS advisories for MikroTik in the last tracking window, 0 flagged as relevant to oil & gas. Newest first.

Critical 9.8 ICSA-26-272-06 · Sep 29, 2026 · MikroTik

MikroTik RouterOS

CISA reports 1 vulnerability in MikroTik RouterOS. Weakness type: Integer Underflow (Wrap or Wraparound). Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.

What to do: Act now: MikroTik recommends users update RouterOS to version 7.24 or later. The upgrade can be downloaded from the MikroTik website.
Medium 4.9 ICSA-26-211-01 · Jul 30, 2026 · MikroTik

MikroTik RouterOS

CISA reports 1 vulnerability in MikroTik RouterOS. Weakness type: Insufficient Session Expiration. Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all a…

What to do: Plan: MikroTik recommends administrators to ensure that when a user's permissions are downgraded, the affected user is fully logged out so the new policy can take effect.
High 8.8 ICSA-26-209-05 · Jul 28, 2026 · MikroTik

MikroTik RouterOS and Cloud Hosted Router

CISA reports 1 vulnerability in MikroTik RouterOS, Cloud Hosted Router. Weakness type: Improper Restriction of Excessive Authentication Attempts. Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access. Highest CVSS v3 score: 8.8 (High), exploit…

What to do: Prioritize: No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.