CVE-2026-67277

MikroTik RouterOS lacks authentication for the btest service, enabling kernel memory disclosure and denial of service.

The missing authentication on the btest service allows attackers to read kernel memory and crash the router, exposing sensitive data and disrupting network operations. DIB organizations must ensure RouterOS is patched and monitored for exploitation, as this flaw aligns with known supply-chain and unpatched vulnerabilities that attackers actively target.

Shame score — A missing authentication on a critical service is a fundamental design flaw that is easily exploitable and has been actively exploited in the wild, indicating severe negligence in secure development and patching.