MikroTik RouterOS API session flaw exposes WireGuard keys
A session-expiration bug in MikroTik RouterOS lets low-privilege API users retain stale permissions, potentially exposing WireGuard private keys.
CISA published an ICS advisory for CVE-2026-14227, an insufficient session expiration flaw (CWE-613) affecting all versions of MikroTik RouterOS with the API enabled. The issue arises when a user's permissions are downgraded or their session times out, but the API session does not properly re-validate the new permission set, allowing continued access at the prior privilege level. According to the advisory summary, this could be leveraged to extract a router's WireGuard private key in plaintext using only low-privilege API access, which would enable full VPN impersonation and decryption of associated traffic.
MikroTik RouterOS is deployed worldwide across the Information Technology critical infrastructure sector, and the vendor is headquartered in Latvia. MikroTik's recommended mitigation is to ensure users are fully logged out when their permissions are reduced, so the new access policy takes effect immediately rather than persisting the old session state. CISA notes no known public exploitation of this vulnerability has been reported at this time, and the standard network-hardening guidance (isolating control system networks, restricting internet exposure, and using updated VPNs) applies.
The vulnerability was responsibly disclosed to CISA by researcher Andre Santos. Given the lack of a CVSS score in the advisory text and the absence of confirmed in-the-wild exploitation, this should be treated as a proof-of-concept-stage risk that organizations running RouterOS with API access enabled should prioritize patching or mitigating, particularly given the sensitivity of exposed VPN key material.
Mentioned in this report
Detection guidance
MikroTik RouterOS API WireGuard Private Key Export
Detects RouterOS API log entries showing a WireGuard interface private-key field being read/exported via the API, especially by sessions not in the full/admin group - the core action abused in CVE-2026-14227 to extract VPN key material via a stale low-privilege session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MikroTik RouterOS API WireGuard Private Key Export
description: Detects API access to WireGuard interface configuration where the private-key
field is retrieved or exported. This is the sensitive action described in CVE-2026-14227,
where a session retaining stale elevated privileges (after permission downgrade/timeout)
is used to pull the router's WireGuard private key over the API, enabling VPN impersonation
and traffic decryption.
tags:
- attack.credential-access
- attack.t1552
logsource:
product: mikrotik
category: application
detection:
selection:
Message|contains|all:
- wireguard
- private-key
Topics|contains: api
filter_full_admin:
Group|contains:
- full
- admin
condition: selection and not filter_full_admin
falsepositives:
- Legitimate full-privilege administrators exporting WireGuard keys for backup or
migration via the API
- Automated configuration-management tools with full admin group membership reading
interface configuration including keys
level: high
id: 9cac90e9-d08d-5416-b975-5b6bace6251c
status: experimental
author: Vorant
MikroTik User Group Permission Downgrade on Account With Active API Session
Flags RouterOS account/user log events where a user's group membership is reduced while the account is or was recently used via the API, the precondition window in which CVE-2026-14227 allows the old (higher) privilege session to remain valid and be abused for further privileged API calls. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MikroTik User Group Permission Downgrade on Account With Active API Session
description: Detects RouterOS 'account' topic log entries indicating a user's group/permission
level was reduced. Combined with CVE-2026-14227, RouterOS may fail to re-validate
an already-open API session against the new lower privilege set, letting the old
session continue acting at the prior level. This rule surfaces the downgrade event
itself for correlation with subsequent API activity from the same user/session,
since the vulnerability's exploitation window begins immediately after this event.
tags:
- attack.persistence
- attack.t1078
logsource:
product: mikrotik
category: application
detection:
selection:
Topics|contains: account
Message|contains|all:
- group
- changed
condition: selection
falsepositives:
- Routine RBAC administration reducing a user's privilege level as part of normal
account lifecycle management
- Scheduled or scripted deprovisioning of contractor/temporary accounts
level: medium
id: 87ba43f7-75ae-5aed-8183-d1a922ca5c67
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free