{"schema":"threatline.record/2","record":{"id":"CVE-2026-103903","aliases":[],"summary":"MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation","details":"An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization policy of a different existing account. The stage-one EC-SRP\nchallenge and proof are verified using the attacker's account, while the\nindependently supplied stage-two username is used to install the target\naccount's privileges. By specifying a higher-privilege account such as admin, a\nlow-privilege user can obtain a full administrative session without knowing the\ntarget account's password and can use that session to increase the privileges\nof the attacker's own account.","categories":["Network & edge"],"product":"RouterOS","vendor":"MikroTik","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103903","source_modified_at":"2026-10-13T11:57:50.805Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"RouterOS","vendor":"MikroTik","versions":[{"status":"affected","version":"7.0.0","lessThan":"7.24.5","versionType":"semver"},{"status":"unaffected","version":"7.25rc1","versionType":"custom"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103903","source_modified_at":"2026-10-13T11:57:50.805Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"RouterOS","ecosystem":null},"version":"7.24.5","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00415,"percentile":0.34722,"score_date":"2026-10-23"},"published_at":"2026-10-12T10:37:23.578Z","modified_at":"2026-10-13T11:57:50.805Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103903","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T11:57:50.805Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103903","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://mikrotik.com/download/changelogs?channelFilter=stable&versionFilter=7.24.5","tags":["release-notes"]},{"source":"CVE List","url":"https://forum.mikrotik.com/t/7-25rc1-testing-is-released/27352","tags":["release-notes"]},{"source":"CVE List","url":"https://br2sec.com/lv/resursi/2026-routeros-winbox-auth-bypass/","tags":["technical-description","third-party-advisory"]},{"source":"CVE List","url":"https://cvd.cert.lv/disclosed/vuln-all-709639748","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-13T03:55:34.306578Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-13T11:57:50.805Z","content_hash":"184730c82ce9d5cfefa3967007c0edec248443dbc8f5d516c997e8fbe207ceff"}}