CVE-2026-93345 MikroTik CVE debrief

Who should care

Network administrators and security teams responsible for MikroTik RouterOS devices, especially those with BGP services exposed, should assess their exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-93345 is a high-severity vulnerability in MikroTik RouterOS that allows unauthenticated attackers to crash the BGP service. Defenders should prioritize verifying exposure, especially for devices with BGP services exposed, and assess the feasibility of upgrading to 7.25beta4 or applying compensating controls. Evidence of exploitation is limited, and affected versions beyond 7.25beta4 require verification.

• Potential BGP service crashes and session termination
• Possible indefinite holding down of the BGP plane
• Service malfunction on affected devices
• Need for verification of exposure and remediation feasibility

Technical summary

The vulnerability exists in the labelled-VPN NLRI iterators of the MikroTik RouterOS routing service. An unauthenticated on-path attacker can send a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, causing the BGP service to crash. Repeatedly sending such packets can indefinitely hold down the BGP plane, leading to session termination and service malfunction.

Defensive priority

Defenders should prioritize verifying exposure of MikroTik RouterOS devices, especially those with BGP services exposed, and assess the feasibility of upgrading to 7.25beta4 or applying compensating controls.

Recommended defensive actions

• Verify MikroTik RouterOS versions and assess exposure to BGP services
• Evaluate the feasibility of upgrading to 7.25beta4 or later
• Implement compensating controls, such as filtering or monitoring BGP traffic
• Monitor for potential service disruptions or crashes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence of exploitation or affected versions beyond 7.25beta4 is limited. Vendor documentation and advisories may offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.