CVE-2026-67281: Unauthenticated file read in Mikrotik RouterOS

Vulnerability summary

CVE-2026-67281 is a high (CVSS 8.7) Path Traversal vulnerability in mikrotik routeros. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2026
   PublishedVulnerability first disclosed.
2. 08-09-2026
   Last modifiedVulnerability information updated.

Description

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.