CVE-2026-103903

Last refreshed2026-10-12

Status: UPDATED | Advisory ID: CVE-2026-103903

Key Details

CVE	CVE-2026-103903
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-12
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	MikroTik RouterOS
Classified as	CWE-863 (Incorrect Authorization)

Vendor	Product	Affected Versions	Patch Status
MikroTik	RouterOS

Vendor

Product

Affected Versions

Patch Status

MikroTik

RouterOS

Subsystems	Industrial Networking & Connectivity
Sectors	Multi-sector

An incorrect authorization vulnerability in the WinBox

authentication flow of MikroTik RouterOS allows a remote authenticated attacker

with credentials for a low-privilege account permitted to use WinBox to obtain

the authorization policy of a different existing account. The stage-one EC-SRP

challenge and proof are verified using the attacker's account, while the

independently supplied stage-two username is used to install the target

account's privileges. By specifying a higher-privilege account such as admin, a

low-privilege user can obtain a full administrative session without knowing the

target account's password and can use that session to increase the privileges

of the attacker's own account. (NVD)

Monitor MikroTik's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-103903
CVE	https://www.cve.org/CVERecord?id=CVE-2026-103903

Source

Reference

NVD

CVE