CVE-2026-67277

This bug is in a “btest” networking feature on MikroTik routers. Attackers can send specially crafted test traffic to trick the router into revealing leftovers from memory and can also crash the router, forcing it to restart. Think of it like leaving a backstage door slightly unlocked: someone can peek at scraps of internal information and, worse, knock the whole performance out for a while.

This matters if you use MikroTik RouterOS devices—especially if they are reachable from the internet and the “btest” service is enabled or can be reached in a way that attackers can send the relevant UDP test traffic. The known exploitation is real-world, so don’t treat this as theoretical. The risk is driven by whether the service is reachable from the internet and whether the router’s configuration allows that btest behavior.

Treat this as urgent because it’s listed in CISA KEV and is confirmed being exploited in the real world. Your best protection is to install the fixed RouterOS versions immediately, before attackers hit your specific devices. Since the CISA remediation due date is 2026-09-13, you should act well before then.

1. Confirm exposure

   • Identify the MikroTik RouterOS version running on each router.
   • Confirm whether the router can be reached from the internet on the relevant management/traffic paths and whether btest is enabled/usable.
   • Check your edge firewall/NAT rules for any UDP access patterns that would allow an outside attacker to reach the btest-related traffic path.

2. Check whether you’re vulnerable

   • This issue was fixed in: 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).
   • If your RouterOS is older than those fixed releases, you should assume you are affected until proven otherwise.

3. Upgrade to the fixed version (preferred)

   • Upgrade to 6.49.21, or 7.23.4, or 7.24.2, following MikroTik’s upgrade procedure for your device.
   • After upgrade, confirm the router is stable and that any services you rely on (WAN connectivity, VPN, internal routing) still work.

4. If you can’t upgrade immediately

   • Follow MikroTik’s and CISA’s mitigation guidance referenced in the vendor advisory and CISA KEV entry.
   • Apply the guidance most practical for your setup: restrict internet reachability to only the required services, and if possible disable btest or block the specific traffic pattern from the internet.
   • If mitigations aren’t available for your configuration, CISA guidance indicates you should consider discontinuing use of the product until you can comply.

5. Validate and monitor

   • Monitor for signs of instability: repeated restarts/crashes, unusual UDP test-related traffic, and error logs around times when external scanning could occur.
   • If your environment includes monitoring/alerting, add an alert for RouterOS service restarts until the upgrade is confirmed across all affected devices.

6. Due date / governance

   • CISA KEV remediation due date: 2026-09-13.
   • Ensure your changes align with CISA’s “BOD 26-04 Prioritizing Security Updates Based on Risk” guidance and any applicable “Forensics Triage Requirements.”

CVE-2026-67277 (CWE-306) in MikroTik RouterOS btest service is a kernel memory disclosure and denial of service issue. The root cause is improper trust/state handling: RouterOS accepts an incoming “related” btest connection before the corresponding primary session completes authentication, enabling an unauthenticated client to initiate an IPv4 UDP test. With certain parameters (notably random-data disabled), the sender can trigger transmission of uninitialized bytes from a kernel packet buffer. A separate malformed/unchecked packet-size interval can lead to unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel (DoS).

Exposure status: Confirmed real-world exploitation is indicated by inclusion in CISA KEV (added 2026-09-10), which means defenders should treat this as actively weaponized rather than theoretical. No public exploit code is on record, and EPSS is provided only as a prediction (the CISA KEV confirmation is the primary driver for urgency here).

Fixed versions: 6.49.21, 7.23.4, and 7.24.2.