CVE-2026-14227
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A product with the MikroTik RouterOS API enabled is vulnerable to insufficient session expiration. Active sessions may retain their previous permission set after inactivity timeouts or user-group changes.
Risk Assessment
An authenticated user whose permissions have been reduced may continue accessing information they should no longer have access to, leading to access control violations.
Recommendation
Update RouterOS to a version that fixes the session expiration mechanism and enforce re-authentication after permission changes.
Other vulnerabilities in MikroTik RouterOS
See all- CVE-2024-27686High
Mikrotik RouterOS versions 6.40.5 through 6.49.10 (fixed in 7) allow a remote attacker to cause a device crash via crafted packet data to the SMB service on TCP port 445.
- CVE-2026-16347High
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.
- CVE-2026-39042High
A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).
- CVE-2023-47310Medium
A misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets. The issue is fixed in version v7.14.
- CVE-2023-24094High
A vulnerability in the bridge2 component of MikroTik RouterOS version 6.40.5 allows attackers to cause a Denial of Service (DoS) by sending crafted packets.
Original NVD description (English source)
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.