CVE-2026-67281 is a high severity (CVSS 7.5) unauthenticated file read in the MikroTik RouterOS WebFig interface. It can disclose root owned files, including configuration stores with credentials. Update to RouterOS 7.24.3 stable or 7.23.6 long-term, and block the web interface from untrusted networks.
What's affected
CERT Polska lists the vulnerable range as RouterOS 7.20 up to but not including 7.23.4, and 7.24 up to but not including 7.24.2. It affects the 7.x branch only. The first fixes were 7.23.4 (long-term) and 7.24.2 (stable).
Later guidance from CERT Polska recommends 7.24.3 or later on stable and 7.23.6 or later on long-term, because the earlier fixes were incomplete for a different CVE in the same disclosure. RouterOS 6 is not listed as affected by this one.
The weaknesses are CWE-22, path traversal, and CWE-824, access of an uninitialized pointer. The record and CERT Polska give the same cause: a newly allocated session keeps a stale uninitialized pointer to a principal that is used for file authorization. With the right preparation, the file serving path uses that pointer with enough rights, and parent directory components in an encrypted URI let the request leave the WebFig file area.
Is it exploited?
The record's KEV flag is false. CERT Polska's warning about active exploitation concerns a combination of two flaws that gives control through SSH. It does not say the WebFig issue is part of that chain. It is still a flaw in the same release and worth treating as urgent, since the WebFig port is often reachable on the same devices.
How to check if you're exposed
Read the version and see whether the web interface is on and where it is reachable from:
/system resource print
/ip service print
The service list shows whether the www and www-ssl services are enabled and what address ranges can use them. An enabled web interface reachable from the internet is the high risk case.
What to do now
- Update to 7.24.3 stable or 7.23.6 long-term, or later in the same channel.
- Restrict the WWW and WWW-SSL services to trusted management networks, or turn them off if you do not use WebFig.
- Assume that credentials stored in the configuration of an exposed, unpatched device could have been read, and rotate them after the update.
- Check the device for unknown users, scripts and scheduler entries, as CERT Polska advises after the SSH chain.
- Read the other entries in CERT Polska's advisory, since they were published together.
Why it matters
Reading files without logging in is serious on a router because configuration stores can hold credentials. The cause is a memory handling bug, an uninitialized pointer, that turns into an authorization bug, because the file server trusts a pointer whose value was never set.
That is a good illustration of why exposure reduction works. Updating fixes the code. Limiting who can reach the management interface limits what any future bug in it can do.
Quick check
Do I need credentials to exploit it?
The record says no. It describes an unauthenticated attacker.
Is RouterOS 6 affected?
CERT Polska lists the 7.x branch only for this CVE, but recommends 6.49.21 for other CVEs in the same disclosure.
Sources
- CERT Polska advisory for the MikroTik RouterOS CVEs
- CERT Polska warning: RouterOS vulnerabilities actively exploited
- MikroTik forum: RouterOS 7.23.4 long-term released
Last reviewed: 18 October 2026.
