MikroTik RouterOS WinBox Split-Principal Authentication Bypass and Privilege Escalation (CVE-2026-103903)

BR²SEC

Cybersecurity Research & Audits

https://br2sec.com/en/resources/cve-2026-103903-routeros-winbox-auth-bypass/

19/10/2026

BR²SEC research has identified a high-severity incorrect authorization vulnerability (CWE-863, CVSS 8.8) in the MikroTik RouterOS WinBox authentication flow. A remote authenticated user with read-only credentials can specify a full administrative account during stage two to obtain an admin session and persistently escalate privileges without knowing the admin password.

Published: 19/10/2026 · 6 min read · Rolands Bīrons

MikroTik RouterOS WinBox Split-Principal Authentication Bypass and Privilege Escalation (CVE-2026-103903) — AI Generated image · BR²SEC

8.8High

Security advisory · BR²SEC research

CVE-2026-103903

CVSS 3.1 · 8.8CVSS 4.0 · 8.7CWE-863CWE-287

Attack vector AV: Network
Complexity AC: Low
Privileges PR: Low
User interaction UI: None
Scope S: Unchanged
Confidentiality C: High
Integrity I: High
Availability A: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HView on Enki Guard Intel

Security Advisory: This vulnerability was discovered by BR²SEC security researcher Rolands Bīrons.

Vulnerability Summary

In the MikroTik RouterOS WinBox authentication protocol flow, the cryptographic identity established during handshake is decoupled from the authorization identity applied to the resulting session. An authenticated user possessing low-privilege credentials (such as an account in the read group) can successfully complete the initial cryptographic challenge using their own credentials, yet submit an administrative username (such as admin) in the second stage.

RouterOS verifies the low-privilege user's cryptographic proof, but installs the target account's full authorization policy for the session. This enables an unprivileged user to obtain a full administrative WinBox session and persistently escalate their own account to the full administrative group without knowing the admin password.

Affected Product and Classification

Vendor: MikroTik (SIA Mikrotīkls)
Product: RouterOS
Affected Component: WinBox authentication and user service (TCP port 8291)
Affected Versions: All RouterOS versions below 7.24.4
Fixed Versions: RouterOS 7.24.5 stable, RouterOS 7.25rc1 testing, and later releases
CVE ID: CVE-2026-103903
Classification: CWE-863 (Incorrect Authorization), CWE-287 (Improper Authentication)
CAPEC: CAPEC-180 (Exploiting Incorrectly Configured Access Control Security Levels), CAPEC-115 (Authentication Bypass)
MITRE ATT&CK: T1078.003 (Valid Accounts: Local Accounts), T1068 (Exploitation for Privilege Escalation)
CVSS 3.1 Base Score: 8.8 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Proposed CVSS 4.0 Base Score: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Impact Assessment

This vulnerability completely breaks the RouterOS Role-Based Access Control (RBAC) model:

1
Full Device Compromise: Any unprivileged account with WinBox access (such as monitoring, audit, or guest accounts) can instantly achieve full administrative control.
2
Confidentiality and Integrity Impact: An elevated session can dump router configuration backups, extract private keys, manipulate firewall and routing policies, and deploy custom packages.
3
No Administrative Password Required: The flaw bypasses authentication without password guessing or brute-force attempts, rendering exploitation immediate and reliable.

Remediation and Recommendations

Upgrade MikroTik RouterOS to version 7.24.5 (stable), 7.25rc1 (testing), or a later version. Verification tests confirm that the split-principal authentication flow is rejected by these releases.