The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently expanded its Known Exploited Vulnerabilities (KEV) catalog, incorporating two significant vulnerabilities found in MikroTik RouterOS. This move underscores the growing concern over active exploitation of these flaws, highlighting the urgency for remediation among users and organizations operating affected systems.
On September 10, CISA officially added vulnerabilities CVE-2026-67277 and CVE-2026-86060 to its roster, informing all affected organizations that they would have until September 13 to implement vendor-recommended mitigations. This brief window for remediation is emblematic of CISA’s assessment of the immediate risk posed by these vulnerabilities, which are currently being exploited in real-world scenarios.
### Understanding the Vulnerabilities
The first vulnerability, CVE-2026-67277, is characterized as a missing-authentication flaw within the bandwidth-test service known as btest, which is part of MikroTik RouterOS. This vulnerability falls under the Common Weakness Enumeration (CWE) identifier 306, suggesting that it could allow unauthorized actors to disclose sensitive kernel memory information. The implications of such a breach are particularly alarming; exposing kernel memory not only risks leaking sensitive data, which could include security credentials or configuration details but also potentially enables attackers to launch denial-of-service (DoS) attacks, crippling network operations.
The second vulnerability, CVE-2026-86060, arises from improper neutralization of argument delimiters in a command, categorized as CWE-88. According to CISA’s KEV entry, this flaw allows an attacker to manipulate the trusted policy mask of RouterOS, which could lead to privilege escalation. If an attacker gains elevated permissions on a network router, they gain the ability to alter routing rules, create persistent backdoors, intercept sensitive traffic, or utilize the compromised device as a pivot point for further attacks within the internal network. Such escalated access poses a significant threat to the integrity and security of an entire network infrastructure.
### CISA’s Recommendations and Urgent Action Required
In light of these vulnerabilities, CISA has mandated forensic triage under Binding Operational Directive 26-04 for CVE-2026-86060. This directive necessitates that organizations not only implement the recommended mitigations but also conduct thorough investigations for any indication of compromise. While ransomware is not explicitly mentioned in CISA’s advisory regarding these specific vulnerabilities, the classification of both as actively exploited vulnerabilities establishes an urgency for organizations to assess their security postures promptly.
Federal Civilian Executive Branch agencies are specifically required to meet the remediation deadline set forth in the KEV catalog. However, CISA strongly advises all organizations utilizing MikroTik RouterOS devices to prioritize the rectification of these vulnerabilities, irrespective of their affiliation. It is crucial for network administrators to identify any RouterOS systems exposed to the internet. They must review vendor advisories for released fixes or mitigations and restrict access to management interfaces, as well as the btest service. Monitoring device logs and scrutinizing configuration changes for signs of unauthorized activities is essential for a proactive defense strategy.
The short three-day window for remediation indicates that CISA considers the operational risks associated with vulnerable RouterOS deployments to be immediate and severe. Organizations that find themselves incapable of swiftly implementing effective mitigations are encouraged to remove exposed devices from internet access until a secure configuration or updated software version can be established.
### Conclusion
With cyber threats continually evolving, the urgency propagated by CISA concerning these MikroTik RouterOS vulnerabilities serves as a wake-up call. Organizations must stay vigilant, ensuring they are equipped with the latest security measures to safeguard their networks against potential intrusions. By taking swift action and remaining informed about the latest cybersecurity threats, entities can better protect their infrastructure and sensitive data from malicious actors. The need for heightened awareness and rapid response in the cybersecurity landscape has never been more evident.