It's fully disclosed now
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/