CVE-2026-67277: MikroTik RouterOS Bandwidth-Test Kernel Memory Disclosure

CVE-2026-67277 is a missing-authentication flaw in MikroTik RouterOS's bandwidth-test (btest) service that lets an unauthenticated network attacker start a UDP bandwidth test before the related session finishes authenticating, leaking uninitialized kernel buffer contents and, via a separate integer-underflow bug in the same path, crashing and restarting the router's kernel.

CVE-2026-67277 (CWE-306, missing authentication for a critical function) is one of six RouterOS flaws MikroTik grouped as "MikroTrick" in its September 2026 security advisory. NVD's description: "RouterOS accepts a 'related' btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With 'random-data=false', the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel" (NVD).

NVD scores the issue at CVSS v3.1 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H — network-reachable, no authentication or user interaction, low confidentiality impact (the memory leak) combined with high availability impact (the kernel restart). The CNA (cert.pl, which coordinated the disclosure) additionally scores it CVSS v4.0 8.8 (high), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N (NVD).

MikroTik's own advisory lists all six "MikroTrick" CVEs together (CVE-2026-67279, CVE-2026-86060, CVE-2026-67276, CVE-2026-67281, CVE-2026-67278 and this one), states CVE-2026-67279 was "seen being exploited in the wild," and gives fixed builds across both release trains: RouterOS 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable); it also notes that the fix shipped for a related CVE (CVE-2026-67278) in the first September round was incomplete and required a follow-up update (MikroTik Security Advisory).

CISA added CVE-2026-67277 to the Known Exploited Vulnerabilities catalog on 2026-09-10, with a required-action due date of 2026-09-13 (CISA KEV). Polish CERT.PL, which analyzed the MikroTrick disclosure, published independent technical detail on the bandwidth-test authentication bypass and the kernel-memory exposure it enables (CERT.PL).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.0156 (75.064th percentile) (FIRST EPSS).

Because this is a pre-authentication flaw reachable by any network client that can open a btest connection, operators of RouterOS devices on any build below the fixed versions above should upgrade immediately and restrict management/bandwidth-test service exposure to trusted networks in the meantime.

• RouterOS accepts an unauthenticated "related" btest connection before the primary session authenticates, letting an attacker start a UDP test that leaks uninitialized kernel buffer data and, via a separate integer-underflow bug, restart the kernel. — NVD
• CVSS v3.1 base score is 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H (NVD); CNA (cert.pl) additionally scores CVSS v4.0 8.8. — NVD
• Fixed in RouterOS 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable); grouped with five other CVEs as "MikroTrick"; one related CVE's first fix was incomplete and needed a follow-up update. — MikroTik Security Advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-10, due date 2026-09-13. — CISA KEV
• EPSS score is 0.0156 (75.064th percentile) as of 2026-10-26. — FIRST EPSS