Is CVE-2026-67277 (MikroTik RouterOS Missing Authentication for Critical Function) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2026-67277 to its Known Exploited Vulnerabilities catalogue on 10 September 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.

Why “Exploited in the Wild” Matters More Than the CVE Label

The practical question is not whether a vulnerability exists, it is whether defenders should treat it as actively exploited. A CISA KEV listing means the issue has crossed from theoretical risk into verified attacker use, which changes response urgency, patch prioritisation, and the need to assume exposure may already have occurred.

For this CVE, the materially important issue is not just the product flaw, but the fact that it affects a router platform often used as a network control point. When exploitation is confirmed in the wild, perimeter assumptions, monitoring coverage, and recovery steps all need to be tightened immediately.

What the Vulnerability Can Do in Practice

The direct answer identifies a missing authentication for a critical function in MikroTik RouterOS, specifically in the btest service. That matters because unauthenticated access to a sensitive function can let an attacker trigger behaviour that was never meant to be exposed to the network, here including kernel memory disclosure and denial of service.

Even when the immediate observed effect is “only” information disclosure or service disruption, defenders should treat router and network appliance flaws as high-impact because they can sit on trusted paths. If the device also participates in management, routing, VPN, or segmentation, a compromise or outage can affect many downstream services at once.

How to Triage Exposure and Response

Start by confirming whether any MikroTik RouterOS instances are reachable where the btest service, management plane, or other exposed administrative surfaces could be abused. If you operate multiple sites or edge devices, inventory by model and RouterOS build first, then verify whether the vulnerable service is enabled or exposed where it should not be.

Because CISA only adds items to KEV when there is reliable evidence of active exploitation, the response should be operational, not speculative. Prioritise remediation on internet-facing devices, high-trust network chokepoints, and any router that supports remote administration or sensitive internal connectivity.

Risk and Threat Considerations

Actively exploited router flaws create two immediate risks: device instability and attacker visibility into memory or control-plane state. For security teams, the bigger concern is that a network appliance can be both a target and a vantage point, so exploitation may affect availability while also increasing the chance that the attacker can learn something useful about the environment.

Failure mechanism: Missing authentication on a critical function allows unauthorised requests to reach a sensitive service path, which can then be abused for memory disclosure or denial of service.

Impact: Expect potential outage, device resets, degraded trust in the affected router, and a need to assess whether the appliance exposed operational detail that could support follow-on intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.PS-05 — Safe and Resilient Configuration	Router exposure and service hardening are central to this exploited appliance flaw.
	DE.CM-01 — Networks and Network Services Monitored	Active exploitation calls for monitoring router traffic and service anomalies.
	RS.MA-1 — Investigation and Analysis	KEV-listed exploitation requires rapid validation of exposure and possible compromise.
Recommendation — Harden RouterOS services and restrict exposed management paths. Monitor network device activity for exploitation and instability signals. Triage affected routers immediately and validate whether compromise indicators exist.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The page concerns an exploited vulnerability requiring remediation prioritisation.
	SC-7 — Boundary Protection	Limiting access to the vulnerable service and router surfaces directly reduces exposure.
Recommendation — Remediate the RouterOS flaw and track completion on exposed devices. Restrict external access to RouterOS services and management interfaces.

Practitioner Guidance

What to verify: Confirm whether the affected RouterOS devices are exposed to untrusted networks, whether btest is enabled, and whether any compensating controls already restrict access to the service plane. If you cannot positively prove the device is not reachable or not exposed, treat it as a live exposure until you can.

Escalation / exception: If patching or service changes must wait, isolate the device, block access to unnecessary services at the network boundary, and increase logging around management access and device restarts. For edge routers, the decision point is blast radius, if the box can influence many users or sites, delay is usually harder to justify.

Practitioner takeaway: For a KEV-listed router flaw, the right question is not “has it been patched eventually?”, it is “could this device already be in the attacker’s path or on a live network path right now?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org