CISA Advisory: MikroTik RouterOS WireGuard Private Key Exposure via Low-Privilege API (CVE-2026-14227)

Vulnerability Overview Vulnerability Name: CVE-2026-14227 Affected Version: MikroTik RouterOS v3.4.9 CVSS Score: Not provided Vulnerability Description: Successful exploitation of this vulnerability allows an attacker to extract the router's WireGuard private key via low-privilege API access, enabling full VPN impersonation and decryption of all associated traffic. Scope Critical Infrastructure Sector: Information Technology Deployment Country/Region: Global Company Headquarters Location: Latvia Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible via the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - Use more secure remote access methods, such as Virtual Private Networks (VPNs), when remote access is required, and recognize that VPNs may have vulnerabilities; therefore, they should be updated to the latest version. - Conduct appropriate impact analysis and risk assessment prior to deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity to CISA for tracking and correlation analysis. - Do not click on web links in unsolicited email messages or open attachments. - Refer to information on identifying and avoiding email fraud to prevent social engineering attacks. Additional Information Release Date: July 30, 2026 Alert Code: ICSA-26-211-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Acknowledgement: Andre Santos reported this vulnerability to CISA Legal Notice and Terms of Use This product is subject to this notice and privacy and usage policies. Revision History Initial Release Date: July 30, 2026 Revision: 1 Summary: Initial release Tags Sector: Information Technology Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Recommendations Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module Toptech Systems RCU II+ and Multiload II+ Johnson Controls OpenBlue Employee Schneider Electric IGSS Feedback Please share your thoughts: We recently updated our anonymous product survey, and your feedback is welcome. Contact Information CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Other Links About CISA Budget and Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback Social Media Facebook X LinkedIn RSS Footer CISA.gov An official website of the U.S. Department of Homeland Security Navbar Topics Spotlight Resources & Tools News & Events Careers About Search Search Share Share: Facebook, Twitter, LinkedIn, Email Related Topics Industrial Control System Vulnerabilities Industrial Control Systems Vulnerability Details Vulnerability Name: CVE-2026-14227 CVSS Score: Not provided Vendor: MikroTik Device: MikroTik RouterOS Vulnerability Type: Insufficient session expiration

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory: MikroTik RouterOS WireGuard Private Key Exposure via Low-Privilege API (CVE-2026-14227)