{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:37.072Z","products":["mikrotik"],"actNowTotal":2,"results":[{"query":"mikrotik","matched":2,"actNow":2,"events":[{"id":"kev-2026-09-25-mikrotik-routeros","url":"https://securitythreatpulse.com/events/kev-2026-09-25-mikrotik-routeros","title":"MikroTik RouterOS: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 66 days old, so many systems are likely still unpatched.","tier":"now","rankScore":3,"rankWhy":["Exploitation is confirmed by an authoritative source."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-67279"],"vendor":"MikroTik","product":"RouterOS","affectedProducts":[{"kind":"direct","slug":"mikrotik/routeros","vendor":"MikroTik","product":"RouterOS","evidence":["kev","cpe"],"vendorKey":"mikrotik","productKey":"routeros"}],"category":{"id":"network-device","label":"Routers, cameras and devices","why":"Routers, cameras and recorders are often forgotten and rarely updated.","doThis":"Update it or replace it. Never leave its admin page open to the internet."},"summary":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","cvss":6.9,"epss":0.02277,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-25","kevDueDate":"2026-09-28","firstSeenAt":"2026-09-25T00:00:00.000Z","updatedAt":"2026-11-10T20:30:23.688Z","newestEvidenceAt":"2026-10-25T01:27:17.427Z"},{"id":"kev-2026-09-10-mikrotik-routeros","url":"https://securitythreatpulse.com/events/kev-2026-09-10-mikrotik-routeros","title":"MikroTik RouterOS: 2 flaws used in attacks; attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 65 days old, so many systems are likely still unpatched. The severity score is critical (9.2).","tier":"now","rankScore":3,"rankWhy":["Exploitation is confirmed by an authoritative source."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-67277","CVE-2026-86060"],"vendor":"MikroTik","product":"RouterOS","affectedProducts":[{"kind":"direct","slug":"mikrotik/routeros","vendor":"MikroTik","product":"RouterOS","evidence":["kev","cpe"],"vendorKey":"mikrotik","productKey":"routeros"}],"category":{"id":"network-device","label":"Routers, cameras and devices","why":"Routers, cameras and recorders are often forgotten and rarely updated.","doThis":"Update it or replace it. Never leave its admin page open to the internet."},"summary":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.","cvss":9.2,"epss":0.06392,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-10","kevDueDate":"2026-09-13","firstSeenAt":"2026-09-10T00:00:00.000Z","updatedAt":"2026-11-09T20:07:40.209Z","newestEvidenceAt":"2026-09-24T00:00:00.000Z"}]}]}