Source: cisa.gov
CVE-2026-67277 is a missing authentication for critical function vulnerability affecting MikroTik RouterOS. The flaw exists in the btest service and can be exploited to achieve kernel memory disclosure and denial of service. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in CISA's implementation guidance for BOD 26-04. MikroTik has published a dedicated support advisory for the September 2026 vulnerability. The vulnerability is rated High criticality. Organizations using MikroTik RouterOS are urged to apply patches immediately. The vulnerability is also tracked in the NVD under the same CVE identifier.
