Vendor dossier / #49
MikroTik vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 5 MikroTik vulnerabilities as of catalog 2026.10.30, 0.3% of all 1,766 entries and rank 49 of 291 vendors. The first was added on 2021-12-01 and the most recent on 2026-09-25; 0 are flagged as used in ransomware campaigns.
- KEV entries
- 50.3% of catalog
- Last 90 days
- +3added
- Ransomware: known
- 00%
- Products
- 1distinct
- First added
- 2021-12-01
- Latest added
- 2026-09-25
- Median days to due
- 3
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 1 |
| 2022 | 1 |
| 2023 | 0 |
| 2024 | 0 |
| 2025 | 0 |
| 2026 | 3 |
QCommon questions
How many MikroTik vulnerabilities are in CISA KEV?
5, as of KEV catalog 2026.10.30 (released 2026-10-30). That is 0.3% of the catalog.
Which MikroTik product has the most KEV entries?
RouterOS, with 5 entries.
How many MikroTik KEV vulnerabilities are linked to ransomware?
0 of 5 (0%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest MikroTik vulnerability added to KEV?
2026-09-25 (CVE-2026-67279).
What is the most common weakness in MikroTik KEV entries?
CWE-841 (CWE-841), listed on 1 entry.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| RouterOS | 5 | 100% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-841 | 1 | 20% |
| CWE-88 | 1 | 20% |
| CWE-306 Missing authentication | 1 | 20% |
| CWE-119 Memory buffer bounds error | 1 | 20% |
| CWE-22 Path traversal | 1 | 20% |
EAll 5 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-67279 | RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | Unknown | CWE-841 | ||
| CVE-2026-86060 | RouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | Unknown | CWE-88 | ||
| CVE-2026-67277 | RouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2018-7445 | RouterOS | MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2018-14847 | RouterOS | MikroTik Router OS Directory Traversal Vulnerability | Unknown | CWE-22 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 5 MikroTik vulnerabilities (0.3% of all entries). Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/vendors/mikrotik/
Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30. Vendor names are CISA's vendorProject strings; KEV Now states no facts about MikroTik beyond this data.