CVE-2026-67281

🗓️ 05 Sep 2026 20:00:58Reported by CERT-PLType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 288 Views🌐 WEB

Unauthenticated file read in RouterOS WebFig /jsproxy via stale principal pointer discloses credentials.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Path Traversal in Mikrotik Routeros	14 Oct 202614:07	–	githubexploit
BDU FSTEC	MikroTik RouterOS WebFig Privilege Escalation	17 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-67281	5 Sep 202621:47	–	circl
Cvelist	CVE-2026-67281 Unauthenticated file read in Mikrotik RouterOS	5 Sep 202620:00	–	cvelist
EUVD	EUVD-2026-72028	5 Sep 202620:00	–	euvd
Kitploit	exploit-mikrotik-2026	12 Oct 202607:26	–	kitploit
Tenable Nessus	MikroTik RouterOS 7.20 < 7.23.4 / 7.24.x < 7.24.2 WebFig Unauthenticated File Read (CVE-2026-67281)	10 Sep 202600:00	–	nessus
Tenable Nessus	MikroTik RouterOS Path Traversal (CVE-2026-67281)	5 Oct 202600:00	–	nessus
NVD	CVE-2026-67281	5 Sep 202620:17	–	nvd
Positive Technologies	PT-2026-86455	3 Sep 202600:00	–	ptsecurity

NVD

Vulners

CNA

Node

mikrotik routerosRange7.20–7.23.4

mikrotik routerosRange7.24–7.24.2

[
  {
    "vendor": "Mikrotik",
    "product": "RouterOS",
    "versions": [
      {
        "status": "affected",
        "version": "7.24",
        "lessThan": "7.24.2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.20",
        "lessThan": "7.23.4",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
mikrotik	www.mikrotik.com/supportsec/september-2026-vulnerability/
cert	www.cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
cert	www.cert.pl/en/posts/2026/09/mikrotik-routeros-cve
forum	www.forum.mikrotik.com/t/7-24-2-stable-is-released/272800
forum	www.forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
npratley	www.npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/

Parameter	Position	Path	Description	CWE
encrypted_uri_frame	query param	/jsproxy/?	Encrypted-URI GET path used to attempt file read via crafted encoded frame (Path A).	CWE-22CWE-824
frame	request body	/jsproxy	M2 message POST path used to trigger file read by crafting an M2 frame (Path B).	CWE-22CWE-824

25 Sep 2026 14:21Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.5

CVSS 48.7

EPSS0.00725

SSVC