{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "MikroTik RouterOS: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/mikrotik--routeros/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/mikrotik--routeros/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89035/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89035/",
   "title": "CVE-2026-89035 disclosed",
   "content_text": "MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.",
   "date_published": "2026-10-21T17:16:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112158/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112158/",
   "title": "CVE-2026-112158 disclosed",
   "content_text": "A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.",
   "date_published": "2026-10-19T16:00:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103903/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103903/",
   "title": "CVE-2026-103903 disclosed",
   "content_text": "An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization policy of a different existing account. The stage-one EC-SRP\nchallenge and proof are verified using the attacker's account, while the\nindependently supplied stage-two username is used to install the target\naccount's privileges. By specifying a higher-privilege account such as admin, a\nlow-privilege user can obtain a full administrative session without knowing the\ntarget account's password and can use that session to increase the privileges\nof the attacker's own account.",
   "date_published": "2026-10-12T10:37:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84411/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84411/",
   "title": "CVE-2026-84411 disclosed",
   "content_text": "The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.",
   "date_published": "2026-10-02T22:09:48Z"
  }
 ]
}