CVE-2026-103903: 369 Swiss MikroTik Services

We found 369 exposed MikroTik WinBox services on Swiss networks reporting an exact RouterOS version affected by CVE-2026-103903. Another 89 reported a fixed version, while 290 ran RouterOS 6, which sits outside the explicit range in the CVE record.

The encouraging result was hidden between 2 observations. In 41 cases, a service that previously reported an affected release had moved to a fixed release by 12 October. The patch is reaching exposed systems, although 85 services still reported RouterOS 7.24.4, the final stable version before the fix.

What CVE-2026-103903 does

CVE-2026-103903 is an authorization flaw in the MikroTik RouterOS WinBox login flow. An attacker needs valid credentials for an account that may use WinBox. This rules out a completely anonymous attack, but the account may have only basic permissions.

The problem appears across 2 stages of the login. RouterOS validates one account first, then uses a separately supplied account name when it installs the permissions for the session. A user who signs in with a basic account can therefore receive the policy of an administrator account without knowing that administrator password.

The result is full control of the router. An attacker could alter network configuration, create access, redirect traffic, or keep a route back into the network. Our detector did not test any of those actions. It read only the public RouterOS version from the WinBox service.

The CVE record gives the flaw a severity of 8.8 out of 10 under CVSS 3.1 and 8.7 under CVSS 4.0. The record was published on 12 October 2026.

Which RouterOS versions are affected

The explicit affected range starts at RouterOS 7.0.0 and ends at 7.24.4. MikroTik released RouterOS 7.24.5, which contains the stable fix, on 1 October 2026. RouterOS 7.25rc1 in the testing channel also contains the fix.

That gives operators a clear stable boundary:

1. Stable RouterOS 7.0.0 through 7.24.4 is affected.
2. RouterOS 7.24.5 stable is fixed.
3. RouterOS 7.25rc1 testing is fixed.
4. Later releases containing the change are fixed.

RouterOS 6 needs careful wording. The explicit version table begins at RouterOS 7.0.0, so we classify RouterOS 6 as outside the stated range. We do not count those services as vulnerable or fixed for this CVE.

How we measured the Swiss exposure

We began with 1’103 unique public WinBox services from an internet exposure index. Registration checks removed 350 addresses on networks registered outside Switzerland. No tagged or banner marked research sensors remained. Another 22 registrations could not be resolved and remain disclosed inside the count.

That left 753 services in the Swiss measurement. We sent each service one ordinary WinBox manifest request, the same request a client uses to list public plugin metadata. It did not attempt authentication, send malformed data, read protected content, or change any state.

665 services answered and supplied an exact current version, giving 88.3 percent direct coverage. Another 86 rows use an exact version preserved in the earlier public observation because the service did not answer our request. Only 2 services had no readable version evidence.

The final buckets cover all 753 services:

1. 369 reported an exact affected version. Of these, 314 answered our direct check and 55 rely on the preserved observation.
2. 89 reported an exact fixed version.
3. 290 reported RouterOS 6, outside the explicit CVE range.
4. 3 reported prerelease versions that the published range does not resolve.
5. 2 exposed no readable version.

The 753 records count services. Several services may belong to one operator, and one anonymous network group accounted for 172 of the records. We use that concentration only to understand the shape of the exposed population. No measured owner is identified.

The patch is already moving

We could compare an earlier exact version with the current response for 665 services. 617 stayed on the same version and 48 changed. Of those changes, 41 moved from an affected version into the fixed range.

That is useful evidence of patch movement, but it does not establish who performed the update or why. Some devices may update automatically. Others may sit behind a provider process. The measurement records only what each service reported at the 2 observation times.

The remaining affected population includes a particularly clear patch target. 85 services reported RouterOS 7.24.4, exactly one stable release behind the fix. 78 of those versions came from the direct check and 7 from the preserved observation.

The oldest exact current response was RouterOS 6.40.8, released in April 2018. 10 services still reported it. That branch is outside the explicit range for this CVE, but its age is a separate maintenance signal.

A safe version detector

We wrote a passive detector that sends one public WinBox manifest request and reads the exact RouterOS version. It reports a match only for stable releases from 7.0.0 through 7.24.4.

The detector passed its schema check and 9 local test cases. We then replayed its final matcher across all 665 stored current manifest responses. It returned 314 matches, exactly the same 314 affected versions found in current responses. There were 0 missing matches, 0 extra matches, and 0 version disagreements.

This check proves the exposed version. It does not attempt the authorization flaw and does not prove that anyone has exploited a device. CVE-2026-103903 was absent from the CISA known exploited catalog when checked on 13 October, and no EPSS score was available. The catalog feed was dated 8 October, before this CVE was published, so its absence does not establish that exploitation has not occurred.

What operators should do

Install RouterOS 7.24.5 stable or a later stable release that contains the fix. Until that update is complete, restrict WinBox to trusted management addresses, remove WinBox permission from basic accounts, or disable the service. Those controls reduce who can reach the flawed login flow, while the update removes the flaw.

Review exposed routers even when they report RouterOS 6. Their CVE status remains outside the published range, and an old public management service still deserves an owner, a support decision, and a current configuration review.

If you want to inspect your own infrastructure, Sentinel scans the public IP your request comes from and creates an AI assisted report. The free scan requires no account and normally completes in 30 to 60 minutes.

Every exposed RouterOS 7 service should report 7.24.5 stable, 7.25rc1 testing, or a later release known to contain the fix. WinBox should be reachable only from the addresses that manage it.