{"vulnerability": "cve-2026-67277", "sightings": [{"uuid": "96b559fa-1683-4399-b8e5-abb4cee764b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117220286803293141", "content": "A severe vulnerability was disclosed for Mikrotik RouterOS (CVE-2026-67277) https://vuldb.com/vuln/399363", "creation_timestamp": "2026-09-05T20:20:30.619617Z"}, {"uuid": "a6d49cfa-0016-417f-8bcc-637fe3ac914d", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1d9ea784-c941-41ec-aa5f-c1cb172bcb68", "content": "", "creation_timestamp": "2026-09-05T22:00:02.446343Z"}, {"uuid": "cff2d83b-9492-453c-9a9e-e05d9263d736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-06T11:00:06.413291Z"}, {"uuid": "718da266-0551-4e51-8205-bf0cef4528c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://www.acn.gov.it/portale/w/mikrotik-rilevato-sfruttamento-in-rete-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-09-06T20:45:04.641484Z"}, {"uuid": "25b5767b-4fc1-4756-ab3c-b3552e0d3d0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://www.cert.si/si-cert-2026-05", "content": "", "creation_timestamp": "2026-09-06T20:45:18.274773Z"}, {"uuid": "b6dc78d8-d700-4d90-ba16-ab016dba1ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-07T01:00:18.041479Z"}, {"uuid": "1fc2f340-ac63-4fbf-9716-b13a29a13ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://infosec.exchange/ap/users/116755351765233076/statuses/117229104212538915", "content": "That is a full wipe, you absolute liability.\nPull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW \u2014 before the raid resets and I lose what remains of my sanity.\nReward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.\n#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)", "creation_timestamp": "2026-09-07T13:38:41.730881Z"}, {"uuid": "7b85912a-a2a9-4a2c-836d-50444b61e763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/mikrotik-security-advisory-av26-887", "content": "", "creation_timestamp": "2026-09-08T16:15:10.819999Z"}, {"uuid": "699ffa75-27e4-43d4-a41f-4984de22dd5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muzz6hqvdt2i", "content": "CVE-2026-67277 is trending. Hype score 7, currently #7 on cvemon.\n\nRouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-67277", "creation_timestamp": "2026-09-08T21:54:53.991541Z"}, {"uuid": "98b04683-80f6-4f19-acfd-fc584b91ea5e", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bb0ee1ae-defa-495f-8b5a-7242b86d5ccb", "content": "", "creation_timestamp": "2026-09-10T20:00:02.077787Z"}, {"uuid": "b4693789-9b2d-4ceb-bd3b-52ad80d9bd8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mv6uglqdsa2k", "content": "\ud83d\uded1 CVE-2026-67277\nMikroTik RouterOS\nCVSS 8.8 / EPSS 0% / KEV: No\nTL;DR: RouterOS accepts a \"related\" btest connection before the corresponding primary session ha\u2026\nhttps://cvesentinel.com/report/CVE-2026-67277?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-10T20:13:16.607750Z"}, {"uuid": "7e768e95-0d9a-4b56-8e0c-9e2a0303466e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mv6zqrlnyp25", "content": "CISA added two actively exploited MikroTik RouterOS flaws to KEV today, CVE-2026-86060 and CVE-2026-67277, with a 13 September deadline. MikroTik confirms exploitation; fixes landed 3 September in 7.24.2, 7.23.4 and 6.49.21. cisa.gov/news-events/ale...", "creation_timestamp": "2026-09-10T21:48:27.432254Z"}, {"uuid": "1509f802-3760-49c7-9f81-d99a046166c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mv74m2655s2v", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-67277", "creation_timestamp": "2026-09-10T22:39:29.967777Z"}, {"uuid": "4321b4df-04b7-474e-9c5f-279b50086f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mv7b4np3oo2i", "content": "Patch XPS EoP CVE-2026-68897 (7.0). CISA KEV adds exploited MikroTik CVE-2026-67277/86060. MotW Zone.Identifier marks downloads. Frozen taskbar: restart Explorer; DISM/SFC. Member: Alt+F4 brightness +7 more stories, 1 reply, 22 new members", "creation_timestamp": "2026-09-11T00:00:21.860617Z"}, {"uuid": "c9f15a00-9cdd-4fc5-8e71-d0f0aada5d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060", "content": "", "creation_timestamp": "2026-09-11T00:15:06.434973Z"}, {"uuid": "0e193342-ca6e-41d0-bebc-4db5df3d0608", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mv7lu7hno72l", "content": "CISA added two actively exploited MikroTik RouterOS bugs (CVE-2026-67277, CVE-2026-86060) to KEV, due 13 Sept. Patch now and take remote admin off the WAN. https://cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-11T03:12:29.760610Z"}, {"uuid": "5eeed48f-85e5-406c-ad58-5004c89369a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mv7omjf72l2v", "content": "~Cisa~\nCISA added two actively exploited MikroTik RouterOS vulnerabilities to its KEV Catalog.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060\n-\n#CVE-2026-67277 #CVE-2026-86060 #ThreatIntel", "creation_timestamp": "2026-09-11T04:01:53.481864Z"}, {"uuid": "14ce5d7e-df39-4310-8e07-d778350c4ad9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mv7qjxfsxo2o", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\uff08CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\uff09 #CISA \uff08Sep 10\uff09\n\nCVE-2026-67277 MikroTik RouterOS\u306b\u304a\u3051\u308b\u91cd\u8981\u6a5f\u80fd\u306e\u8a8d\u8a3c\u6b20\u843d\u306e\u8106\u5f31\u6027\nCVE-2026-86060 MikroTik RouterOS \u30b3\u30de\u30f3\u30c9\u306b\u304a\u3051\u308b\u5f15\u6570\u533a\u5207\u308a\u6587\u5b57\u306e\u4e0d\u9069\u5207\u306a\u7121\u52b9\u5316\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-11T04:36:14.725961Z"}, {"uuid": "d4639ff0-a01d-4580-b10a-8cc4a0b53b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mv7wwfsojy23", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-67277: \u26a0\ufe0f CVE-2026-67277: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-67277-routeros-accepts-a-related-btest-connection", "creation_timestamp": "2026-09-11T06:30:35.589621Z"}, {"uuid": "6c03caeb-ab01-4031-ba8c-2a9c952db682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvawu7byqa2p", "content": "~Cybergcca~\nMikroTik RouterOS flaws are exploited in the wild; CISA added two CVEs to KEV, while four other vendors require updates.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060, CVE-2026-67276\n-\n#CVE #MikroTik #ThreatIntel", "creation_timestamp": "2026-09-11T16:02:00.882112Z"}, {"uuid": "223f2bda-c0db-4e46-a2a6-973b2385ed80", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cca02293-7749-4ac4-9ec4-adceddd4aa0d", "content": "", "creation_timestamp": "2026-09-11T20:01:21.875976Z"}, {"uuid": "7f14a1b2-c3a2-4887-ab76-3d182fe94e36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvc3zjg6gb2j", "content": "\ud83d\udccc CVE-2026-67277 - RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use... https://www.cyberhub.blog/cves/CVE-2026-67277", "creation_timestamp": "2026-09-12T03:07:08.109527Z"}]}