Loading vulnerability…
Unauthenticated file disclosure in MikroTik RouterOS WebFig
CVE-2026-67281 is an unauthenticated file-read vulnerability affecting MikroTik RouterOS 7.x WebFig. A newly allocated session retains a stale, uninitialized principal pointer that is subsequently used for file authorization. An attacker can manipulate allocator state so that dereferencing this pointer grants sufficient authorization, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace. Successful exploitation exposes root-owned files, including configuration stores containing credentials. The vulnerability combines access to an uninitialized pointer with directory traversal and is fixed in RouterOS 7.23.4 Long-term and 7.24.2 Stable.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers can bypass file-authorization and namespace restrictions to disclose root-owned files, including configuration stores containing credentials. This compromises sensitive device configuration and authentication secrets. File modification, code execution, and service disruption are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, disable WebFig where feasible or restrict access to trusted administrative networks using network access controls. Block or limit untrusted access to the WWW and WWW-SSL management services, minimize Internet exposure, and monitor for suspicious administrative activity.
Patch, then assume compromise.
Upgrade affected RouterOS 7.x installations to 7.23.4 or a later fixed release in the Long-term channel, or 7.24.2 or a later fixed release in the Stable channel. The vulnerability-specific affected-branch description limits this issue to RouterOS 7.x; references to 6.49.21 in broader update guidance do not establish that RouterOS 6.x is affected.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.