Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: CVE-2026-67281 is an unauthenticated file read flaw in MikroTik RouterOS WebFig that can expose root-owned configuration stores and credentials, with a CVSS v4.0 score of 8.7 and affected versions across all maintained branches, according to CYCOGNITO. The issue turns management-plane exposure into a broader identity and access risk because stolen router credentials can unlock adjacent VPN, monitoring, and admin systems.
NHIMG editorial — based on content published by CYCOGNITO: Sample of assets impacted by MikroTik file read vulnerability, identified by the CyCognito Platform
By the numbers:
- CVE-2026-67281 carries a CVSS v4.0 base score of 8.7, which places it in the High severity range.
Questions worth separating out
Q: What breaks when a router management interface can read files without authentication?
A: A pre-authentication file-read flaw breaks the assumption that management data stays inside the device boundary.
Q: Why do exposed router credentials create wider identity risk than a single device compromise?
A: Router credentials often have trust relationships that extend beyond the router itself.
Q: How should security teams reduce risk from exposed ports in internet-facing environments?
A: Security teams should start with default-deny exposure, then allow only the services that are truly required.
Practitioner guidance
- Restrict WebFig to a dedicated management network Bind WebFig only to a trusted admin address range and remove www and www-ssl from devices that do not need browser-based management.
- Inventory every RouterOS asset and its reachability Include branch devices, partner-managed equipment, and cloud hosted router instances in a current inventory, then confirm which ones answer on untrusted networks.
- Rotate any credentials stored in router configuration After patching or suspected exposure, replace credentials found in device config stores, then review whether those secrets were reused elsewhere.
What's in the full article
CYCOGNITO's full analysis covers the operational detail this post intentionally leaves for the source:
- Exact affected RouterOS version ranges across each maintained branch and how to reconcile them against fleet inventory
- Vendor guidance on verifying device logs, flagged status, and suspicious configuration changes after upgrade
- The exposure patterns observed across sectors and deployment types, including internet-facing management planes
- Mitigation steps for devices where WebFig is unused, including service shutdown and perimeter blocking
👉 Read CYCOGNITO's analysis of CVE-2026-67281 and RouterOS WebFig exposure →
CVE-2026-67281 and router management exposure: what teams should fix?
Explore further
14/09/2026 10:10 am
Management-plane file reads are identity incidents when they expose reusable secrets. This flaw is not only about unauthorized file access on a router. It becomes an identity governance issue the moment configuration stores contain credentials, certificates, or tokens that can open other systems. The NHI security lesson is straightforward: secrets embedded in infrastructure appliances create cross-domain blast radius when the appliance is exposed.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- The State of Secrets in AppSec also found that companies dedicate an average of 32.4% of security budgets to secrets management and code security, with US organisations leading at 40.8%.
A question worth separating out:
Q: What should teams do after patching a network appliance with a file-read vulnerability?
A: They should verify the build version, inspect logs, and look for unrecognized scripts, accounts, or configuration changes that could indicate prior compromise. Then they should rotate any secrets stored on the device and review whether those credentials were reused elsewhere. A patched appliance can still be an old access path.
👉 Read our full editorial: MikroTik CVE-2026-67281 shows how router file reads expose credentials
