Six MikroTik RouterOS CVEs Enter NVD After Active-Exploitation Warning

What happened

CERT Polska disclosed six RouterOS vulnerabilities on 5 September and warned that attackers had been successfully combining two RouterOS flaws against internet-accessible SSH services since at least 2 September. NVD published the six related CVE records in the 6 September IST reporting window.

Technical mechanism

The published records cover SSH authentication and rekey paths, certificate-validation behavior, bandwidth-test authorization, WebFig file disclosure, and an SSH-login argument path that can alter a trusted policy mask. The sources do not identify the exact two CVEs used in observed attacks.

Why it matters

The event combines a coordinated set of RouterOS flaws, official fixed-version guidance, and a confirmed active-exploitation warning involving internet-reachable management infrastructure.

Impact

Six RouterOS vulnerability records entered NVD after CERT Polska warned of active attacks combining two unspecified RouterOS flaws against internet-accessible SSH services.

Response

Upgrade to RouterOS 6.49.21, 7.23.4, 7.24.2, or a later supported release; restrict management exposure; rotate administrative and SSH credentials where exposure existed; and investigate for unauthorized configuration or system changes.

Defensive lessons

• Patch the complete affected RouterOS surface because the confirmed active two-vulnerability chain was not mapped to named CVEs.
• Remove direct internet exposure from RouterOS management and service interfaces, and restrict administration to controlled paths.
• Review RouterOS users, scripts, scheduler entries, files, configuration, support outputs, and outbound connections after exposure.

Evidence register

1. CERT Polska — RouterOS vulnerabilities actively exploited (verified)
2. CERT Polska — Six vulnerabilities in MikroTik RouterOS (verified)
3. National Vulnerability Database — CVEs published during the 6 September 2026 IST window (verified)