CVE CVE-2026-14227
Severity MEDIUM · CVSS 3.1 4.9 · CVSS 4.0 6.9
Weakness CWE-613
Affected versions All versions
Fixed version not yet announced
Actively exploited No, as of the date of this article
CISA Advisory none
Published 2026-07-30

What is the CVE-2026-14227 vulnerability?

CVE-2026-14227 is a flaw in the session management of the RouterOS API that allows active sessions to retain their previous set of permissions after an inactivity timeout or changes to user groups. As a result, an authenticated user whose privileges have been revoked can continue to access confidential information until the session is closed.

Which RouterOS versions are vulnerable?

All RouterOS versions are listed as vulnerable. The fixed version has not yet been announced.

Is my router at risk?

A router is exposed if the RouterOS API is enabled and reachable from untrusted networks. If the API is not used by scripts or management software, you can eliminate the risk by disabling it; if it is required, it must be restricted exclusively to the hosts that call it.

Is the CVE-2026-14227 vulnerability actively exploited?

As of the date of this article, CVE-2026-14227 is not listed in the CISA KEV catalog, and ENISA does not report it as being exploited.

How to protect your router from CVE-2026-14227?

Immediate protection consists of disabling the RouterOS API if it is not used, or restricting inbound access to it only to the specific hosts that need it. While waiting for the fixed version, you must monitor active sessions and verify that the assigned permissions are consistent with the principle of least privilege.

Which RouterOS commands are needed to mitigate CVE-2026-14227?

Temporary mitigation: api service

The flaw concerns the RouterOS API, used by scripts and management software. If no program uses it, turn it off; otherwise, restrict it to the hosts that call it.

/ip service print
# se l'API non serve
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
# se serve: solo dagli host che la usano (sostituisci con i tuoi)
/ip service set api-ssl address=192.168.88.10/32

Update RouterOS

The only definitive fix is an update. Save the configuration first; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Frequently asked questions

What is the CVSS score for CVE-2026-14227?

CVE-2026-14227 has a CVSS v3.1 score of 4.9 (MEDIUM) and a CVSS v4.0 score of 6.9 (MEDIUM), both assigned by ics-cert@hq.dhs.gov.

Does CVE-2026-14227 require authentication to be exploited?

CVE-2026-14227 requires an authenticated user, as indicated by the CVSS vector specifying PR:H (Privileges Required: High).

Is disabling the API enough to mitigate CVE-2026-14227?

Yes, disabling the RouterOS API eliminates the attack surface of CVE-2026-14227, since the flaw exclusively concerns the session management of that service.

What is the CWE classification for CVE-2026-14227?

CVE-2026-14227 is classified as CWE-613: Insufficient Session Expiration.

Official sources