CVE-2026-103903: mikrotik routeros Incorrect Authorization

Vulnerability summary

CVE-2026-103903 is a high (CVSS 8.8) Incorrect Authorization vulnerability in mikrotik routeros. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.4% of scored vulnerabilities.

Timeline

1. 12-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.