{"vulnerability": "CVE-2026-67277", "sightings": [{"uuid": "96b559fa-1683-4399-b8e5-abb4cee764b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117220286803293141", "content": "A severe vulnerability was disclosed for Mikrotik RouterOS (CVE-2026-67277) https://vuldb.com/vuln/399363", "creation_timestamp": "2026-09-05T20:20:30.619617Z"}, {"uuid": "a6d49cfa-0016-417f-8bcc-637fe3ac914d", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1d9ea784-c941-41ec-aa5f-c1cb172bcb68", "content": "", "creation_timestamp": "2026-09-05T22:00:02.446343Z"}, {"uuid": "cff2d83b-9492-453c-9a9e-e05d9263d736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-06T11:00:06.413291Z"}, {"uuid": "718da266-0551-4e51-8205-bf0cef4528c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://www.acn.gov.it/portale/w/mikrotik-rilevato-sfruttamento-in-rete-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-09-06T20:45:04.641484Z"}, {"uuid": "25b5767b-4fc1-4756-ab3c-b3552e0d3d0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://www.cert.si/si-cert-2026-05", "content": "", "creation_timestamp": "2026-09-06T20:45:18.274773Z"}, {"uuid": "1fc2f340-ac63-4fbf-9716-b13a29a13ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://infosec.exchange/ap/users/116755351765233076/statuses/117229104212538915", "content": "That is a full wipe, you absolute liability.\nPull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW \u2014 before the raid resets and I lose what remains of my sanity.\nReward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.\n#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)", "creation_timestamp": "2026-09-07T13:38:41.730881Z"}, {"uuid": "7b85912a-a2a9-4a2c-836d-50444b61e763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/mikrotik-security-advisory-av26-887", "content": "", "creation_timestamp": "2026-09-08T16:15:10.819999Z"}, {"uuid": "699ffa75-27e4-43d4-a41f-4984de22dd5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muzz6hqvdt2i", "content": "CVE-2026-67277 is trending. Hype score 7, currently #7 on cvemon.\n\nRouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-67277", "creation_timestamp": "2026-09-08T21:54:53.991541Z"}, {"uuid": "98b04683-80f6-4f19-acfd-fc584b91ea5e", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bb0ee1ae-defa-495f-8b5a-7242b86d5ccb", "content": "", "creation_timestamp": "2026-09-10T20:00:02.077787Z"}, {"uuid": "b4693789-9b2d-4ceb-bd3b-52ad80d9bd8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mv6uglqdsa2k", "content": "\ud83d\uded1 CVE-2026-67277\nMikroTik RouterOS\nCVSS 8.8 / EPSS 0% / KEV: No\nTL;DR: RouterOS accepts a \"related\" btest connection before the corresponding primary session ha\u2026\nhttps://cvesentinel.com/report/CVE-2026-67277?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-10T20:13:16.607750Z"}, {"uuid": "7e768e95-0d9a-4b56-8e0c-9e2a0303466e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mv6zqrlnyp25", "content": "CISA added two actively exploited MikroTik RouterOS flaws to KEV today, CVE-2026-86060 and CVE-2026-67277, with a 13 September deadline. MikroTik confirms exploitation; fixes landed 3 September in 7.24.2, 7.23.4 and 6.49.21. cisa.gov/news-events/ale...", "creation_timestamp": "2026-09-10T21:48:27.432254Z"}, {"uuid": "1509f802-3760-49c7-9f81-d99a046166c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mv74m2655s2v", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-67277", "creation_timestamp": "2026-09-10T22:39:29.967777Z"}, {"uuid": "4321b4df-04b7-474e-9c5f-279b50086f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mv7b4np3oo2i", "content": "Patch XPS EoP CVE-2026-68897 (7.0). CISA KEV adds exploited MikroTik CVE-2026-67277/86060. MotW Zone.Identifier marks downloads. Frozen taskbar: restart Explorer; DISM/SFC. Member: Alt+F4 brightness +7 more stories, 1 reply, 22 new members", "creation_timestamp": "2026-09-11T00:00:21.860617Z"}, {"uuid": "c9f15a00-9cdd-4fc5-8e71-d0f0aada5d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060", "content": "", "creation_timestamp": "2026-09-11T00:15:06.434973Z"}, {"uuid": "0e193342-ca6e-41d0-bebc-4db5df3d0608", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mv7lu7hno72l", "content": "CISA added two actively exploited MikroTik RouterOS bugs (CVE-2026-67277, CVE-2026-86060) to KEV, due 13 Sept. Patch now and take remote admin off the WAN. https://cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-11T03:12:29.760610Z"}, {"uuid": "5eeed48f-85e5-406c-ad58-5004c89369a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mv7omjf72l2v", "content": "~Cisa~\nCISA added two actively exploited MikroTik RouterOS vulnerabilities to its KEV Catalog.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060\n-\n#CVE-2026-67277 #CVE-2026-86060 #ThreatIntel", "creation_timestamp": "2026-09-11T04:01:53.481864Z"}, {"uuid": "14ce5d7e-df39-4310-8e07-d778350c4ad9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mv7qjxfsxo2o", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\uff08CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\uff09 #CISA \uff08Sep 10\uff09\n\nCVE-2026-67277 MikroTik RouterOS\u306b\u304a\u3051\u308b\u91cd\u8981\u6a5f\u80fd\u306e\u8a8d\u8a3c\u6b20\u843d\u306e\u8106\u5f31\u6027\nCVE-2026-86060 MikroTik RouterOS \u30b3\u30de\u30f3\u30c9\u306b\u304a\u3051\u308b\u5f15\u6570\u533a\u5207\u308a\u6587\u5b57\u306e\u4e0d\u9069\u5207\u306a\u7121\u52b9\u5316\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-11T04:36:14.725961Z"}, {"uuid": "d4639ff0-a01d-4580-b10a-8cc4a0b53b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mv7wwfsojy23", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-67277: \u26a0\ufe0f CVE-2026-67277: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-67277-routeros-accepts-a-related-btest-connection", "creation_timestamp": "2026-09-11T06:30:35.589621Z"}, {"uuid": "6c03caeb-ab01-4031-ba8c-2a9c952db682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvawu7byqa2p", "content": "~Cybergcca~\nMikroTik RouterOS flaws are exploited in the wild; CISA added two CVEs to KEV, while four other vendors require updates.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060, CVE-2026-67276\n-\n#CVE #MikroTik #ThreatIntel", "creation_timestamp": "2026-09-11T16:02:00.882112Z"}, {"uuid": "223f2bda-c0db-4e46-a2a6-973b2385ed80", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cca02293-7749-4ac4-9ec4-adceddd4aa0d", "content": "", "creation_timestamp": "2026-09-11T20:01:21.875976Z"}, {"uuid": "7f14a1b2-c3a2-4887-ab76-3d182fe94e36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvc3zjg6gb2j", "content": "\ud83d\udccc CVE-2026-67277 - RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use... https://www.cyberhub.blog/cves/CVE-2026-67277", "creation_timestamp": "2026-09-12T03:07:08.109527Z"}, {"uuid": "a421cad7-2f8c-46ea-ba62-edc66c4b450b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "published-proof-of-concept", "source": "https://t.me/sopkacentr/742", "content": "\u041f\u043e \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c (\u041d\u041a\u0426\u041a\u0418) \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u0445 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u00a0CVE-2026-67276,\u00a0CVE-2026-86060,\u00a0CVE-2026-67279,\u00a0CVE-2026-67277,\u00a0CVE-2026-67278,\u00a0CVE-2026-67281, \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u0441\u0435\u0442\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442.\n\u00a0\n\u0412 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438\u00a0MikroTik\u00a0RouterOS\u00a0\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043d\u0430\u0440\u0443\u0448\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u043c.", "creation_timestamp": "2026-09-13T01:00:04.233198Z"}, {"uuid": "2dd9660d-a4fd-4ce4-b26a-c72923fba16b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67277", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/117264675753501005", "content": "We have started reporting out (daily) MikroTik instances with exposed proprietary services, such as WinBox & Bandwidth Test server (btest): https://www.shadowserver.org/what-we-do/network-reporting/accessible-mikrotik-service-report/\nAround 2.6M exposed instances shared daily. Top: Brazil, Indonesia, USA.\nTree map stats: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=mikrotik&source=mikrotik6&data_set=count&scale=log&auto_update=on\nThese should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 https://nvd.nist.gov/vuln/detail/cve-2026-67277\nYou can find all our MikroTik detections in Device ID report https://www.shadowserver.org/what-we-do/network-reporting/device-identification-report/ (around 3M daily): https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=mikrotik&dataset=count&limit=100&group_by=geo&stacking=stacked&auto_update=on\nBackground: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "creation_timestamp": "2026-09-13T16:29:12.980951Z"}, {"uuid": "0e17b09f-a6c4-4a14-8c06-c7117e733da7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mvg2kzq2fk2b", "content": "These should not be publicly accessible on the Internet due to potential vulnerabilities, like CVE-2026-67277 nvd.nist.gov/vuln/detail/...\n\nYou can find all our MikroTik detections in Device ID report www.shadowserver.org/what-we-do/n... (around 3M daily): dashboard.shadowserver.org/statistics/i...", "creation_timestamp": "2026-09-13T16:51:50.657161Z"}, {"uuid": "94d43e67-4a95-4bcf-9730-ebce1b6e9e84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mvg2l3p5wk2b", "content": "These should not be publicly accessible on the Internet due to potential vulnerabilities, like CVE-2026-67277 nvd.nist.gov/vuln/detail/...\n\nYou can find all our MikroTik detections in Device ID report www.shadowserver.org/what-we-do/n... (around 3M daily): dashboard.shadowserver.org/statistics/i...", "creation_timestamp": "2026-09-13T16:51:51.125419Z"}, {"uuid": "be458dfa-3121-4c8d-9feb-623762fb4e90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mvg2l3p5wl2b", "content": "These should not be publicly accessible on the Internet due to potential vulnerabilities, like CVE-2026-67277 nvd.nist.gov/vuln/detail/...\n\nYou can find all our MikroTik detections in Device ID report www.shadowserver.org/what-we-do/n... (around 3M daily): dashboard.shadowserver.org/statistics/i...", "creation_timestamp": "2026-09-13T16:51:51.608874Z"}, {"uuid": "4bf89bca-0955-43c6-ad34-e86a32f49f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-mikrotik-routeros-patch-immediately", "content": "", "creation_timestamp": "2026-09-18T12:45:11.863674Z"}, {"uuid": "d3ab832e-5603-4510-8f28-656dbeb8fc33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis", "content": "", "creation_timestamp": "2026-09-22T16:45:27.065522Z"}, {"uuid": "09604f52-fd12-4120-8f93-c59f540e4b0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67277", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwe5kg7cwf2j", "content": "~Cybergcca~\nMikroTik and Microsoft flaws are actively exploited; patch affected systems.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060, CVE-2026-65660\n-\n#CyberSecurity #ThreatIntel #Vulnerabilities", "creation_timestamp": "2026-09-25T16:04:59.096927Z"}]}