MikroTik RouterOS flaw exposes WireGuard private keys
CVSS 4.9 doesn't capture the operational reality: low-privilege API access yields full VPN impersonation and plaintext decryption.
TL;DR
CISA published ICSA-26-211-01 on CVE-2026-14227, an insufficient session-expiration vulnerability in all versions of MikroTik RouterOS. An authenticated user whose permissions have been downgraded may retain prior access levels after inactivity timeouts or group changes, meaning an attacker with low-privilege API access can extract the router's WireGuard private key in plaintext. MikroTik has not released a patch; the vendor recommends forcibly logging out users whenever their permissions are reduced. For contractors and MSPs running MikroTik for remote-access infrastructure, this is an inventory-and-controls-now problem, not a medium-severity footnote.
The scoring disconnect on CVE-2026-14227 is stark enough to warrant naming directly. CVSS 3.1 assigns it a 4.9, medium. The vector tells a different story: network-accessible, low attack complexity, no user interaction, and a confidentiality impact rated high because the extracted artifact is the WireGuard private key. With that key, an attacker doesn't need to escalate privileges. They can stand up an impersonating VPN endpoint and decrypt traffic at will.
The mechanism is a session-expiration failure (CWE-613). When a RouterOS administrator downgrades a user's permissions (reducing API access from, say, full read-write to a restricted role) active sessions don't always refresh to reflect the new policy. The session sticks at the old privilege level until the user is explicitly logged out. The same flaw applies after inactivity timeouts. An attacker who obtains low-privilege API credentials once can persist at an earlier, higher-access tier indefinitely, including the level that permits WireGuard key extraction.
What MikroTik says, and doesn't
MikroTik's mitigation guidance is procedural, not a code fix: ensure that when permissions are downgraded, the affected user is fully logged out so the new policy takes effect. That's a workaround, not a remediation. The advisory lists all RouterOS versions as affected (vers:all/*) with no patched release identified. The open question for every shop running MikroTik in production is whether a firmware update is coming and on what timeline. The advisory directs users to MikroTik's generic support page.
Why this matters for contractors and MSPs
MikroTik RouterOS is pervasive in managed service provider environments precisely because it's cost-effective remote-access infrastructure. An MSP typically manages dozens or hundreds of customer endpoints through a centralized RouterOS deployment. A single session-expiration exploit in that environment doesn't compromise one device, it potentially exposes every WireGuard tunnel the MSP manages through that router. For defense contractors whose DFARS 7012 or CMMC obligations include protecting CUI in transit, a compromised VPN endpoint is a reportable incident, not just an IT ticket.
This advisory lands two days after ICSA-26-209-05, which covered a separate MikroTik RouterOS brute-force vulnerability scored at CVSS 8.8. That one also had no fix available at publication time. Two unpatched RouterOS vulnerabilities in the same week, both affecting remote-access security, shifts the risk calculus from "watch and wait" to "inventory every MikroTik device on the network and verify session-timeout controls now."
CISA notes no known public exploitation specifically targeting this vulnerability has been reported to the agency at this time. For the practitioner, that's a narrow window, the vulnerability is documented, the exploit path is straightforward, and the mitigations are manual. The CVSS score won't protect you.
Published ·Deep Fathom