{"schema_version":"1","data":[{"id":2961,"advisory_id":"56bf8af1-9a8a-4ab8-8830-963dcde489fc","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14847","source_published_at":"2021-12-01T00:00:00+00:00","published_at":"2026-10-24T21:26:52.855538+00:00","extraction_method":"structured","technologies":["core-kev","routeros"],"cve_ids":["CVE-2018-14847"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MikroTik Router OS Directory Traversal Vulnerability","summary":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-14847","products":[{"name":{"value":"RouterOS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-14847","aliases":["CVE-2018-14847"],"affected":[],"modified":"2021-12-01T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-22"],"cveID":"CVE-2018-14847","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-14847","dueDate":"2022-06-01","product":"RouterOS","dateAdded":"2021-12-01","vendorProject":"MikroTik","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","vulnerabilityName":"MikroTik Router OS Directory Traversal Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2018-14847","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1437,"advisory_id":"a0fa5add-0d9e-4ee1-8be6-189ccbcaefc1","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7445","source_published_at":"2022-09-08T00:00:00+00:00","published_at":"2026-10-24T21:02:33.600835+00:00","extraction_method":"structured","technologies":["core-kev","routeros"],"cve_ids":["CVE-2018-7445"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","summary":"In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-7445","products":[{"name":{"value":"RouterOS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7445","aliases":["CVE-2018-7445"],"affected":[],"modified":"2022-09-08T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2018-7445","notes":"https://www.coresecurity.com/core-labs/advisories/mikrotik-routeros-smb-buffer-overflow#vendor_update, https://mikrotik.com/download; https://nvd.nist.gov/vuln/detail/CVE-2018-7445","dueDate":"2022-09-29","product":"RouterOS","dateAdded":"2022-09-08","vendorProject":"MikroTik","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.","vulnerabilityName":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2018-7445","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":53,"advisory_id":"a90432d3-19e9-488e-a2fb-2932f1c8a904","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277","source_published_at":"2026-09-10T00:00:00+00:00","published_at":"2026-10-24T20:39:54.51378+00:00","extraction_method":"structured","technologies":["core-kev","routeros"],"cve_ids":["CVE-2026-67277"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","summary":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-67277","products":[{"name":{"value":"RouterOS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-67277","aliases":["CVE-2026-67277"],"affected":[],"modified":"2026-09-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-306"],"cveID":"CVE-2026-67277","notes":"https://mikrotik.com/supportsec/september-2026-vulnerability/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67277","dueDate":"2026-09-13","product":"RouterOS","dateAdded":"2026-09-10","vendorProject":"MikroTik","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.","vulnerabilityName":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-67277","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":52,"advisory_id":"1c48f52f-be0a-48e4-a346-dbf6fbac6cf3","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060","source_published_at":"2026-09-10T00:00:00+00:00","published_at":"2026-10-24T20:39:53.906962+00:00","extraction_method":"structured","technologies":["core-kev","routeros"],"cve_ids":["CVE-2026-86060"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","summary":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-86060","products":[{"name":{"value":"RouterOS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-86060","aliases":["CVE-2026-86060"],"affected":[],"modified":"2026-09-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-88"],"cveID":"CVE-2026-86060","notes":"https://mikrotik.com/supportsec/september-2026-vulnerability ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86060","dueDate":"2026-09-13","product":"RouterOS","dateAdded":"2026-09-10","vendorProject":"MikroTik","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.","vulnerabilityName":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-86060","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":31,"advisory_id":"3fb14f93-787c-4b8c-b02a-ec1400e663bc","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279","source_published_at":"2026-09-25T00:00:00+00:00","published_at":"2026-10-24T20:39:40.543323+00:00","extraction_method":"structured","technologies":["core-kev","routeros"],"cve_ids":["CVE-2026-67279"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","summary":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-67279","products":[{"name":{"value":"RouterOS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-67279","aliases":["CVE-2026-67279"],"affected":[],"modified":"2026-09-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-841"],"cveID":"CVE-2026-67279","notes":"https://mikrotik.com/supportsec/september-2026-vulnerability ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67279","dueDate":"2026-09-28","product":"RouterOS","dateAdded":"2026-09-25","vendorProject":"MikroTik","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","vulnerabilityName":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-67279","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-67279","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"RouterOS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67279","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false}],"next_after":2961,"next_before":31}