MikroTik RouterOS API session flaw exposes WireGuard keys
A session-expiration bug in MikroTik RouterOS lets low-privilege API users retain stale permissions, potentially exposing WireGuard private keys.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for CVE-2026-14227, an insufficient session expiration flaw (CWE-613) affecting all versions of MikroTik RouterOS with the API enabled. The issue arises when a user's permissions are downgraded or their session times out, but the API session does not properly re-validate the new permission set, allowing continued access at the prior privilege level. According to the advisory summary, this could be leveraged to extract a router's WireGuard private key in plaintext using only low-privilege API access, which would enable full VPN impersonation and decryption of associated traffic.
MikroTik RouterOS is deployed worldwide across the Information Technology critical infrastructure sector, and the vendor is headquartered in Latvia. MikroTik's recommended mitigation is to ensure users are fully logged out when their permissions are reduced, so the new access policy takes effect immediately rather than persisting the old session state. CISA notes no known public exploitation of this vulnerability has been reported at this time, and the standard network-hardening guidance (isolating control system networks, restricting internet exposure, and using updated VPNs) applies.
The vulnerability was responsibly disclosed to CISA by researcher Andre Santos. Given the lack of a CVSS score in the advisory text and the absence of confirmed in-the-wild exploitation, this should be treated as a proof-of-concept-stage risk that organizations running RouterOS with API access enabled should prioritize patching or mitigating, particularly given the sensitivity of exposed VPN key material.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs