CISA Flags MikroTik RouterOS Flaws as Actively Exploited, Adds to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on September 10 that two vulnerabilities in MikroTik RouterOS have been placed on its Known Exploited Vulnerabilities (KEV) catalog, signaling that malicious actors are already leveraging these weaknesses in operational networks.

CISA’s KEV catalog is a public inventory of software flaws that have been confirmed to be under active exploitation. By highlighting such vulnerabilities, the agency aims to give federal and private-sector defenders a clear, prioritized list of threats that require immediate attention, complementing broader vulnerability‑management programs.

MikroTik RouterOS powers a wide range of networking equipment, from small‑office routers to carrier‑grade platforms used by internet service providers worldwide. Its popularity stems from a flexible feature set and low cost, which makes it a common component in both commercial and consumer environments. Consequently, any compromise of RouterOS can provide attackers with privileged network access, traffic interception, or the ability to pivot deeper into an organization’s infrastructure.

According to the original report from GBHackers, the two flaws are being weaponized in the wild, though the agency has not disclosed technical details such as CVE identifiers in this brief. Analysts observing threat‑intel feeds have noted increased scanning activity targeting MikroTik devices, suggesting that threat actors are probing for the same weaknesses now listed by CISA. Exploitation could lead to remote code execution, credential theft, or denial‑of‑service conditions, all of which raise the risk of broader network disruption.

Organizations that deploy MikroTik hardware are urged to review CISA’s advisory, apply any available patches, and verify that default credentials have been changed. Network segmentation, intrusion‑detection monitoring, and regular firmware updates are standard mitigations recommended by both CISA and industry best practices. As the KEV list continues to evolve, the agency will likely update its guidance, and stakeholders should stay tuned for further notices that may outline additional remediation steps or emerging threat activity.