CVE-2026-89035 MikroTik CVE debrief

Who should care

Defenders responsible for MikroTik RouterOS WebFig interfaces, especially those with administrative access, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-89035 allows attackers to bypass authentication in MikroTik RouterOS WebFig interfaces. Defenders should verify exposure, especially for administrative interfaces, and assess remediation feasibility.

• Persistent administrative access can be gained by replaying captured session tokens
• Verification of exposure and remediation feasibility is necessary
• Clearing the token store can mitigate the vulnerability

Technical summary

The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input. The user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability allows attackers to bypass authentication in MikroTik RouterOS WebFig interfaces by replaying captured session tokens across new ECDH sessions. Affected versions of MikroTik RouterOS are those prior to a vendor-supplied patch, and defenders should verify exposure of WebFig interfaces, especially those with administrative access.

Defensive priority

Defenders should prioritize verifying exposure of MikroTik RouterOS WebFig interfaces, especially those with administrative access, and assess the feasibility of token store clearing.

Recommended defensive actions

• Verify exposure of MikroTik RouterOS WebFig interfaces to untrusted networks
• Assess the feasibility of clearing the token store
• Monitor for suspicious WebFig login attempts
• Consider implementing additional authentication mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected versions and remediation steps require verification from official sources. Affected MikroTik RouterOS deployments should be verified for exposure, especially those with WebFig interfaces accessible to untrusted networks. Defenders should check for official vendor guidance on patched versions and potential workarounds. The vulnerability's impact on administrative access and potential persistence should be assessed. Additional sources

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.