CVE-2026-67277 is a missing-authentication flaw in MikroTik RouterOS, rated CVSS 3.1 8.2 (HIGH). RouterOS accepts a "related" bandwidth-test (btest) connection before the corresponding primary session has completed authentication; an unauthenticated client can use that state to start an IPv4 UDP test, and with random-data=false the sender transmits an uninitialised tail from a kernel packet buffer. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 September 2026 on evidence of active exploitation, describing it as a missing authentication for a critical function.