CVE-2026-89028 – MikroTik RouterOS

MikroTik's RouterOS update fixes eight vulnerabilities in SSH, WebFig, the web management service, btest, SMB and BGP. Attackers are actively exploiting CVE-2026-67276, CVE-2026-67277, CVE-2026-67279 and CVE-2026-86060. CVE-2026-67276 (CVSS 9.2, Critical) lets an attacker who knows an authorized RSA modulus forge an SSH signature and open a command channel as that user without the private key. CVE-2026-86060 (CVSS 9.2, Critical) abuses argument handling in the SSH login path to change the policy mask and escalate privileges. CVE-2026-67277 (CVSS 8.8, High) lets an unauthenticated client start btest sessions that leak kernel memory and can restart the kernel. CVE-2026-67279 (CVSS 6.9, Medium) lets an unauthenticated client skip SSH authentication and create or overwrite files that hold configuration and diagnostic data.

CVE-2026-84411 (CVSS 9.8, Critical) is a pre-authentication integer underflow in the web management service that gives a remote attacker root code execution with a single request. Public proof-of-concept code exists for CVE-2026-81281 (CVSS 8.7, High), an unauthenticated WebFig file read that exposes root-owned configuration stores containing credentials. CVE-2026-89028 (CVSS 7.5, High) corrupts heap memory in the SMB daemon and enables remote code execution. CVE-2026-93345 (CVSS 7.5, High) lets an unauthenticated on-path attacker keep BGP down with one malformed UPDATE packet. Versions 6.49.21, 7.23.4 and 7.24.2 fix the exploited flaws, but the BGP fix ships only in the 7.25beta4 development build.