MikroTik RouterOS
MikroTik RouterOS API session flaw allows WireGuard private key extraction via low-privilege access (CVE-2026-14227).
A critical insufficient session expiration vulnerability (CVE-2026-14227) in MikroTik RouterOS allows authenticated attackers with low-privilege API access to extract the router's WireGuard private key in plaintext. Active sessions retain their previous permission set after inactivity timeouts or user-group downgrades, enabling full VPN impersonation and traffic decryption. All RouterOS versions are affected; CISA advises immediate mitigation including forced logout when user permissions are reduced.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MikroTik?
Get an email when a new story names MikroTik, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-14227 reveals a critical session expiration failure in MikroTik RouterOS where active sessions retain elevated permissions even after inactivity timeouts or privilege downgrades occur. This allows any low-privilege authenticated API user to extract the router's WireGuard private key in plaintext, enabling full VPN impersonation and traffic decryption. The vulnerability is particularly dangerous because it affects all RouterOS versions and targets network infrastructure that is often implicitly trusted. When session lifecycle management fails to enforce real-time permission changes, the principle of least privilege becomes effectively meaningless, turning any compromised low-privilege account into a gateway for catastrophic network exposure.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-14227