Practical guides, industry updates and experience for informed cybersecurity decisions.
ResearchFeatured resource
19/10/2026 · 6 min read
MikroTik RouterOS WinBox Split-Principal Authentication Bypass and Privilege Escalation (CVE-2026-103903)
BR²SEC research has identified a high-severity incorrect authorization vulnerability (CWE-863, CVSS 8.8) in the MikroTik RouterOS WinBox authentication flow. A remote authenticated user with read-only credentials can specify a full administrative account during stage two to obtain an admin session and persistently escalate privileges without knowing the admin password.
Read article