CVE-2026-103903

A high-severity incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with low-privilege credentials to escalate privileges. The flaw exists because the stage-one EC-SRP challenge is verified against the attacker's acco...

EUVD-2026-97325

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP...