CVE-2026-67277

What is the MikroTik RouterOS btest service?

RouterOS is the operating system on MikroTik's routers and wireless devices, with a large installed base among internet service providers, small businesses, and home labs. The btest (bandwidth test) service is a built-in diagnostic that measures throughput between two RouterOS devices. Like the rest of the RouterOS management surface, it is frequently left reachable on internet-facing interfaces, which is what turns a diagnostic tool into an attack surface at scale. MikroTik's ubiquity has repeatedly made unpatched RouterOS a building block for botnets and proxy networks.

Overview

CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the RouterOS btest service, rated CVSS 8.2. An unauthenticated attacker can trigger kernel memory disclosure and a denial of service. It was part of the six-CVE RouterOS disclosure coordinated by CERT Polska, the same batch that produced the MikroTrick takeover chain. MikroTik shipped fixes on 2026-09-03, and CISA added this CVE to KEV on 2026-09-10.

Affected Versions

MikroTik did not publish full vulnerable-version ranges. Treat any RouterOS release earlier than the fixed build for its train as affected. The fixes were released 2026-09-03.

Technical Details

RouterOS permits a "related" btest connection from an unauthenticated client before the primary session has authenticated. That gap enables two distinct problems in the btest handling:

• Kernel memory disclosure. When an attacker initiates an IPv4 UDP bandwidth test with random-data=false, the service transmits an uninitialized tail from a kernel packet buffer, leaking kernel memory contents to the attacker.
• Denial of service. A second defect, an unchecked or inverted packet-size interval, causes an unsigned-integer underflow that produces an anomalously large fragmented output, which crashes or restarts the RouterOS kernel.

Attack characteristics:

• Authentication: none required
• Complexity: low
• Vector: network, to the btest UDP service
• Impact: high availability impact plus limited confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

This is a separate finding from the MikroTrick takeover chain (CVE-2026-86060 plus an SSH authentication bypass). CVE-2026-67277 does not by itself give administrative control; its danger is information leakage and forced reboots, and CISA's KEV listing reflects independently confirmed exploitation.

Discovery

CERT Polska (CERT.pl), with Slawomir Rozbicki credited in the research, discovered the vulnerability as part of a coordinated disclosure of six RouterOS CVEs published on 2026-09-07.

Exploitation Context

CISA added CVE-2026-67277 to the KEV catalog on 2026-09-10, indicating confirmed exploitation. It shares the September RouterOS disclosure with the actively exploited MikroTrick chain; Shadowserver reported roughly 122,500 MikroTik devices with exposed SSH interfaces around this period, an indicator of how many devices expose management services generally. No specific threat-actor attribution for this CVE and no public proof of concept had been published as of 2026-09-16.

Remediation

1. Upgrade RouterOS to the fixed build for your train (see table) immediately.
2. Disable or restrict the btest service on public and WAN interfaces. If bandwidth testing is not needed, turn it off; otherwise limit it to trusted management IP ranges via firewall rules.
3. Restrict management access generally. The same exposure that enables this flaw enables the MikroTrick SSH chain; lock down all management services to trusted networks.
4. Monitor for indicators: unexpected kernel crashes or reboots, and unusual UDP bandwidth-test traffic from unrecognized sources.
5. Apply the whole September RouterOS batch, since the fixed builds above also close the MikroTrick privilege-escalation and authentication-bypass CVEs.