CISA Flags Two MikroTik RouterOS Bugs as Actively Exploited

The advisory does not describe a specific victim, campaign, or exploitation method, so the scope of civilian impact remains unclear. It does, however, identify RouterOS systems as a priority for investigation, particularly where devices are reachable from the public internet or could provide broad control after compromise.

CISA’s notice also references Binding Operational Directive 26-04, which sets risk-based vulnerability management expectations for Federal Civilian Executive Branch agencies. For other organizations, the KEV listing is still a useful signal that ordinary patch queues may be insufficient.

Teams should confirm whether affected RouterOS versions are deployed, determine exposure, apply the vendor-supported fix or mitigation when available, and look for signs of prior compromise rather than assuming remediation alone closes the risk.

Plan for AI-Assisted Abuse as an Operations Problem, Not Just a Tool Problem