CVE-2026-67277: MikroTik RouterOS btest missing authentication leaks kernel memory and crashes kernel

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is an unauthenticated network-reachable missing authentication issue with memory disclosure and kernel restart impact, and it is in CISA KEV with an exploit-tagged reference indicating active exploitation.

What it is

RouterOS accepts a "related" btest connection before the primary session is authenticated, letting an unauthenticated client start an IPv4 UDP test. With random-data=false the sender emits an uninitialized tail from a kernel packet buffer, and a separate unchecked inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output and can restart the RouterOS kernel. The flaw is a missing authentication check on a critical function and is listed in CISA KEV, so internet-exposed btest services are the immediate concern.

Impact

An unauthenticated attacker can read uninitialized kernel packet-buffer memory and force anomalously large fragmented output that can restart the RouterOS kernel, giving information disclosure plus denial of service.

Attack surface

Reachable over the network through the btest service on RouterOS; the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N, so no authentication and no user interaction are required. Any RouterOS instance exposing btest to untrusted networks is in scope.

Exploitation

CVE-2026-67277 was added to CISA KEV on 2026-09-10 with a 2026-09-13 due date, and a reference is tagged Exploit, indicating active exploitation; EPSS is low at 0.00869 (56th percentile), so the KEV listing and exploit reference carry more weight than the EPSS score.

What to do

• Upgrade to a fixed release: 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable).
• If immediate patching is not possible, block or disable the btest service on internet-facing interfaces and restrict it to trusted management networks.
• Follow the vendor security advisory and CISA KEV required action, including BOD 26-04 patching guidance, and discontinue use where mitigations are unavailable.
• Audit exposure of RouterOS management and btest ports and remove direct internet reachability.
• Verify the running version after upgrade, since the fix spans separate long-term and stable branches.

Detection

• Monitor for unexpected btest connections, especially "related" sessions arriving before a primary session is authenticated.
• Alert on RouterOS kernel restarts or unexpected reboots and correlate them with inbound btest traffic.
• Watch for anomalously large fragmented UDP output originating from RouterOS devices.
• Review firewall and flow logs for external hosts reaching btest ports on RouterOS devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.