CISA Warns of Actively Exploited MikroTik RouterOS Flaws

MikroTik’s RouterOS powers networking equipment used by businesses, internet providers and other organizations, making vulnerabilities in the platform a potentially broad security risk. Poland’s CERT Polska used artificial intelligence to help uncover multiple RouterOS weaknesses and reported that some had already been exploited in real-world attacks, raising the urgency for administrators to update exposed devices before attackers can gain access or interfere with network traffic.

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited MikroTik flaws to its Known Exploited Vulnerabilities catalog and ordered federal agencies to complete remediation by Sept. 13. The warning came as the Shadowserver Foundation identified about 2.6 million MikroTik routers exposed to the internet worldwide, including nearly 19,000 in Taiwan. The figures do not establish that every exposed device is vulnerable, but they illustrate the scale of the potential attack surface.