Critical WebFig vulnerability in MikroTik RouterOS

A critical session vulnerability has been found in WebFig, the browser-based management interface of MikroTik RouterOS. The vulnerability, tracked as CVE-2026-89035, is rated critical with a 9.1 score on the CVSS 4.0 scale. At its core, a previously captured session token can be reused in a new connection: the attacker does not need to know the password.

Session token remains valid on new connections

According to the bulletin published by VulnCheck, the problem starts in the libucrypto.so file’s makeSessionKey function. Tokens are generated using fixed salts, and no input specific to the session or connection channel is taken into account. The service that validates admin sessions also compares the token against the record in the login store without checking the channel context. When these two shortcomings combine, a valid WebFig session token captured over the network can be replayed in a new ECDH session, allowing access to the interface with admin privileges. Access persists until the token store is manually cleared.

The bulletin states that the vulnerability expands the impact of CVE-2025-61481. That record described exposure at the transport layer but did not provide a permanent fix. The new vulnerability allows the same weakness to be used in a way that completely bypasses authentication. The bulletin records that Valentin Lobstein (Chocapikk) reported the vulnerability.

Which versions are affected

Affected versions: RouterOS 7.24.0 through 7.24.5, and 7.23.6 and older 7.x versions. In other words, almost any RouterOS installation that has not been updated in the last few months is at risk. The vulnerability requires the WebFig interface to be reachable over the network; if the interface is only accessible from the local network, the attacker must first breach that network or monitor traffic. That is why the NVD record is still marked “Awaiting Analysis”; FIRST’s EPSS model also estimates the likelihood of exploitation within 30 days at a low 0.27%.

The vulnerability is not currently on CISA’s Known Exploited Vulnerabilities (KEV) list. So there is no evidence that it is being used in exploitation campaigns. However, replaying a session token is a method that is hard to distinguish from a normal admin login in logs; this makes the vulnerability a candidate for future exploit lists.

Fix status is unclear

MikroTik released RouterOS 7.25 on October 22, 2026. The official changelog for the release includes two security entries: CVE-2026-31431 and CVE-2026-67280. However, the list does not include an entry for CVE-2026-89035 or the WebFig session token issue. Some third-party write-ups claim that the fix came in version 7.24.6; however, there is no version numbered 7.24.6 on MikroTik’s download server. Therefore, the vendor has not yet confirmed which version closes the vulnerability. Instead of blindly applying RouterOS updates, it makes sense to test 7.25 on a test device first.

What to do in the meantime

The most effective step is to block WebFig from the internet. In the IP > Services menu, restrict the address in the webfig entry to the local network; if external access is needed, connect over VPN. If you do not use WebFig at all, disable the service entirely; WinBox and SSH are enough for administration. If you must keep the interface open, use strong passwords and two-step verification for admin accounts.

If you see a suspicious admin session, restarting RouterOS and changing admin passwords is the most practical way to clear the token store. Check the logs for WebFig sessions from unexpected source IPs; terminate active sessions from the Users menu. Because similar vulnerabilities have also been seen on enterprise devices, you need to review whether router management interfaces are exposed to the internet after every update, not just once a year.

Source: NVD · VulnCheck