cve 2026 14227

This tag covers CVE-2026-14227, a MikroTik RouterOS API session-management vulnerability detailed in CISA advisory ICSA-26-211-01. The flaw can leave a user's prior permissions active after their account has been downgraded or an inactivity timeout occurs, creating a risk for organizations that rely on RouterOS user groups to contain accounts or revoke access during incidents. The advisory rates the issue 4.9 under CVSS v3.1 and notes it requires high privileges, so it is not an unauthenticated router takeover. Discussions on WindowsForum.com focus on the practical implications for enterprise IT and security teams managing MikroTik devices, particularly around incident response and role changes.