Is CVE-2018-14847 (MikroTik Router OS Directory Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2018-14847 to its Known Exploited Vulnerabilities catalogue on 1 December 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

What the KEV listing tells you about exploitation

The practical answer is that this CVE should be treated as active exploitation, not a theoretical exposure. CISA only places vulnerabilities in the Known Exploited Vulnerabilities catalogue when it has reliable evidence of real-world abuse, so the right question becomes whether your RouterOS estate is exposed and whether attackers may already have used the flaw to read or write files.

For vulnerability tracking and confirmation, cross-check the record in CVE Program and the authoritative KEV entry in CISA Known Exploited Vulnerabilities Catalog. If you are still triaging the exposure, use the vendor advisory and the KEV record rather than secondary summaries for version and remediation details.

Why this vulnerability is dangerous in practice

The underlying issue is a directory traversal flaw in the WinBox interface, which means an attacker may be able to reach files outside the intended path boundary. That matters because file read access can expose configuration, credentials, session material, or other sensitive local data, while write access can alter device state, plant persistence, or prepare follow-on compromise.

Directory traversal on an edge device is especially concerning because the device often sits on a trust boundary. Once the attacker can interact with local files, the impact is not limited to the web interface itself, it can extend to management access, operational visibility, and the integrity of downstream network paths that depend on the router.

What to do if you cannot patch immediately

If remediation must wait, treat the device as a high-priority exposure and reduce reachable attack surface first. Restrict administrative access to trusted management networks, remove unnecessary exposure of WinBox, and monitor for any signs that files, configuration, or credentials have been touched. The objective is to narrow the reachable path while you prepare the permanent fix.

Because this flaw can be abused remotely, short-term compensating controls should focus on containment and evidence preservation. Review management-plane logs, recent configuration changes, unexpected account activity, and any unexplained outbound connections or reboot behaviour. If the device supports it, preserve a copy of current configuration and relevant logs before making changes so you can compare pre- and post-remediation state.

Risk and Threat Considerations

This CVE is not just a patch-management item, it is an exploitation risk on an internet-facing management surface. Attackers value flaws like this because they can provide direct access to local files or device configuration without needing normal authentication paths, which can turn a router into a foothold, a persistence point, or a stepping stone into the internal network.

Failure mechanism: A traversal bug in WinBox can let an attacker escape the intended file path and interact with arbitrary local files, which may expose secrets or allow unwanted modification of device state.

Impact: The likely consequences include credential exposure, configuration tampering, persistence, and broader network compromise if the router is trusted by other systems or used for management access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation demands rapid identification and remediation of exposed RouterOS instances.
Recommendation — Prioritise KEV-listed RouterOS exposure for immediate remediation and exception review.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about whether a specific CVE is being exploited in the wild and how to validate exposure.
	SI-2 — Flaw Remediation	A KEV-listed exploitation case requires prompt patching or mitigation of the vulnerable product.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation checking depends on reviewing logs and configuration-change evidence.
Recommendation — Scan for exposed RouterOS assets and track KEV-listed findings until remediated. Apply the vendor fix or compensating control for the RouterOS traversal flaw without delay. Review logs and configuration changes for signs of prior abuse after remediation.
MITRE ATT&CK	T1036 — Masquerading	Directory traversal and file tampering can be used to blend malicious activity into normal device operation.
Recommendation — Map suspicious file and configuration changes to likely attacker tradecraft in detection workflows.

Practitioner Guidance

What to prioritise: Confirm whether any MikroTik RouterOS instance is reachable through WinBox or otherwise exposed to untrusted networks, then sort those systems ahead of lower-risk asset classes. If the device is internet-facing or supports critical routing, treat it as urgent even if you have not seen obvious abuse.

What to verify: Check whether the device has evidence of unexpected file access, configuration drift, new local users, or unexplained changes to management settings. In a case like this, absence of an alert is not proof of safety, because the point of the flaw is to reach data the attacker should not normally see or alter.

Decision rule: If the device cannot be patched quickly, isolate it from broad management access and plan credential rotation for any accounts, keys, or secrets that may have been stored or retrievable on the box. If you can patch promptly, do that first, then validate the configuration and review for earlier compromise.

Practitioner takeaway: For KEV-listed router flaws, the priority is not just remediation, it is deciding whether the device has already been used as an access path and whether that exposure changed your trust in the surrounding network.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org