MikroTik
CISA Adds MikroTik RouterOS SSH Bypass to KEV
The KEV-listed RouterOS SSH bypass requires branch-matched updates and management-access restrictions. Preserve recovery access and inspect router configuration and security indicators; a successful patch or clean indicator alone does not establish an uncompromised appliance.
Captive Portal Triage: Connected, No Login Page, No Internet
Find the first failed captive-portal layer, from association and addressing through discovery, authentication, access policy and upstream routing. Compare clients and preserve logs before changing settings; discovery and NAT behavior depend on the design.
PisoWiFi Daily Operator Checklist
A PisoWiFi daily operations checklist for checking power, ISP, Wi-Fi, DHCP, DNS, captive portal login, vouchers, sessions, and daily logs.
CVE-2026-86060: MikroTik RouterOS MikroTrick policy-mask privilege escalation
MikroTik RouterOS policy-mask manipulation can escalate privileges. Upgrade the affected release, restrict untrusted SSH access, and inspect users, scripts and configuration even when the router does not report a Flagged state.
CVE-2026-67277: MikroTik RouterOS btest unauthenticated memory disclosure and denial of service
Missing authentication in RouterOS btest can disclose kernel memory or interrupt service. Check the service and release, then install the supported fix; restricting SSH alone does not establish that this btest flaw is resolved.