CVE CVE-2026-103903
Severity HIGH · CVSS 3.1 8.8 · CVSS 4.0 8.7
Weakness CWE-863
Affected versions < 7.24.5
Fixed version 7.24.5, 7.25rc1
Actively exploited No, as of the date of this article
CISA Advisory none
Published 2026-10-12

What is the CVE-2026-103903 vulnerability?

The vulnerability consists of an improper authorization flaw (CWE-863) in the WinBox authentication flow. A remote attacker authenticated with low-privilege account credentials can obtain the authorization policy of another existing account. The first-phase EC-SRP challenge and proof verification uses the attacker’s account, while the second-phase username, provided independently, is used to install the target account’s privileges. By specifying a higher-privilege account, such as admin, a low-privilege user can obtain a full administrative session without knowing the target account’s password and use that session to elevate their own account’s privileges.

Which RouterOS versions are vulnerable?

The vulnerable versions are all those below 7.24.5. The available fixed versions are 7.24.5 and 7.25rc1. Version 7.25rc1 is a development release (release candidate) and must not be installed in production environments without specific evaluation; stable versions prior to 7.24.5 remain vulnerable.

Is my router at risk?

A router is exposed if the WinBox service is active and reachable from untrusted networks, either via IP address or via MAC address. If WinBox access is limited exclusively to the internal administration network and low-privilege accounts are not exposed to untrusted users, the risk is reduced. However, the presence of low-privilege accounts with WinBox access on a network reachable from external sources makes the router vulnerable.

Is the CVE-2026-103903 vulnerability actively exploited?

As of the date of this article, there is no evidence that the vulnerability is being actively exploited. It is not present in the CISA KEV catalog, and ENISA does not report it as exploited.

How to protect the router from CVE-2026-103903?

Update RouterOS to version 7.24.5 or higher to apply the fix. Pending the update, limit WinBox access (both via IP and via MAC) exclusively to the trusted administration network and disable WinBox access from untrusted networks. Verify that no low-privilege accounts with WinBox access are exposed to unauthorized users.

Which RouterOS commands are needed to mitigate CVE-2026-103903?

Temporary mitigation: winbox service

The flaw affects WinBox, both via IP and via MAC address. Both access methods must be limited to the administration network.

/ip service print
# Winbox via IP solo dalla rete di gestione (sostituisci con la tua)
/ip service set winbox address=192.168.88.0/24
# Winbox via MAC: spegnilo, o limitalo a un'interface-list di gestione
/tool mac-server mac-winbox set allowed-interface-list=none

Update RouterOS

The only definitive fix is the update. Save the configuration first; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Frequently asked questions

What is the CVSS score of CVE-2026-103903?

The CVSS v3.1 score for CVE-2026-103903 is 8.8 (High), with CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score is 8.7 (High).

Which RouterOS version fixes CVE-2026-103903?

The stable version that fixes CVE-2026-103903 is 7.24.5. Version 7.25rc1 also contains the fix, but it is a development release and is not recommended for production environments without specific evaluation.

Is disabling WinBox enough to mitigate CVE-2026-103903?

Disabling WinBox access from untrusted networks reduces exposure, but full mitigation requires updating to version 7.24.5 or later. Restricting WinBox access to the trusted administration network is an effective containment measure while waiting for the update.

Is CVE-2026-103903 in the CISA KEV catalog?

No, CVE-2026-103903 is not present in the CISA KEV catalog as of the date of this article. It is not reported as actively exploited, nor flagged by ENISA as an exploited vulnerability.

Official sources