Key points
- The flaw affects RouterOS versions up to 7.23.6 and 7.24.5, rated CVSS 9.1 Critical.
- Fixed salts in token generation allow stolen credentials to work across new secure connections.
- This vulnerability extends the impact of the earlier CVE-2025-61481 transport-layer issue.
Administrators managing MikroTik networks face a severe risk as attackers can now maintain persistent control over devices using stolen session tokens. The National Vulnerability Database records this issue as CVE-2026-89035, assigning it a critical severity score of 9.1. This flaw allows unauthorised users to bypass standard login requirements by reusing previously captured authentication data.
In plain English
When a user logs into the WebFig interface, the system creates a unique token to prove their identity. Normally, this token is tied to a specific, secure conversation between the browser and the router. In this case, the token is not unique to that conversation. An attacker who captures this token can reuse it in a completely new connection. The router accepts it as valid because it does not check whether the token matches the current session context.
The background
This vulnerability stems from how the `makeSessionKey` function in `libucrypto.so` generates tokens. It uses fixed salts rather than incorporating channel-specific or session-specific input. Consequently, the user service validates these tokens against the login store without verifying the channel context. According to the NVD record, this flaw extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure but lacked a corresponding fix.
What changes now
Network operators must assume that any captured session token from affected RouterOS versions could be reused indefinitely. The vulnerability persists until the token store is explicitly cleared. As noted in this publication's own archive, authentication bypasses often lead to full administrative control. Here, the risk is similar: stolen tokens grant persistent access, allowing attackers to manipulate configurations without needing valid passwords.
The attacker's path
Teams usually monitor for anomalous login patterns or unexpected configuration changes. In this scenario, the weakness lies in the validation logic that ignores session context. Attackers exploit this by replaying old tokens, effectively skipping the authentication stage entirely. This technique serves to establish persistent administrative access rather than initial entry. Check whether your monitoring tools alert on token reuse or unusual session durations, as standard logins may appear legitimate despite being fraudulent.
What to do and how to stay safe: MikroTik
- Audit all RouterOS devices to confirm they are not running versions up to 7.23.6 or 7.24.5.
- Monitor WebFig access logs for repeated token usage or logins from unexpected locations.
- Force all active administrative sessions to expire immediately to clear the token store.
- Review firewall rules to restrict WebFig access to trusted management networks only.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MikroTik RouterOS versions are affected by CVE-2026-89035?
The vulnerability affects RouterOS versions up to 7.23.6 and up to 7.24.5.
Does this flaw allow unauthenticated access?
No, it requires attackers to capture a valid session token first, which they then replay to bypass authentication checks.
Is there a fix available for this token replay vulnerability?
The source material does not state that a patch or update has been released; no fix has been confirmed yet.
