{"id":"CVE-2026-86060","kind":"vulnerability","aliases":["CVE-2026-86060"],"related":[],"title":"mikrotik routeros: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited…","description":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"MikroTik RouterOS does not neutralize argument delimiters in a command, letting an attacker change the trusted RouterOS policy mask and gain higher privileges. CISA lists it as actively exploited and CERT Polska published a technical analysis.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-10T00:00:00+00:00","products":[{"name":"MikroTik RouterOS","fixed":["6.49.21","7.23.4","7.24.2","7.25beta3"],"affected":"6.0.0 to before 6.49.21; 7.0.0 to before 7.23.4; 7.24 before 7.24.2","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["6.49.21"],"affected":">= 6.0, < 6.49.21","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["7.23.4"],"affected":">= 7.0, < 7.23.4","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["7.24.2"],"affected":">= 7.24, < 7.24.2","ecosystem":"vendor"},{"name":"MikroTik RouterOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","mikrotik","network-gear","privilege-escalation","routeros","self-hosted","ssh"],"not_affected_if":["fixed-version"],"how_to_check":"Check the installed RouterOS version (/system resource print) and compare it to the fixed versions.","fix":"Upgrade RouterOS to 6.49.21, 7.23.4, or 7.24.2 or later, per the MikroTik advisory.\nFollow CISA BOD 26-04 guidance and the forensics triage requirements if exposure is suspected.","status":"resolved","published_at":"2026-09-05T20:17:18+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T22:41:45+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:41:45Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade RouterOS to 6.49.21, 7.23.4, or 7.24.2 or later, per the MikroTik advisory.\nFollow CISA BOD 26-04 guidance and the forensics triage requirements if exposure is suspected.","reach":"network","title":"MikroTik RouterOS: argument delimiter flaw lets attackers escalate privileges","impact":"high","summary":"MikroTik RouterOS does not neutralize argument delimiters in a command, letting an attacker change the trusted RouterOS policy mask and gain higher privileges. CISA lists it as actively exploited and CERT Polska published a technical analysis.","category":"infrastructure","nicknames":["MikroTrick"],"who_cares":["mikrotik","routeros","self-hosted","network-gear"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker escalates privileges on the router and controls its policy","analyst_note":"Confirm the attack prerequisites (credentials, SSH or API reach) and the exact detection steps from the CERT Polska MikroTrick analysis and the MikroTik September 2026 advisory.","how_to_check":"Check the installed RouterOS version (/system resource print) and compare it to the fixed versions.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["fixed-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000606,"input_tokens":3518,"output_tokens":509,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected and fixed RouterOS versions and the vendor advisory in MikroTik's security notes, and confirm the vulnerable command and how to check for exposure.","search":"'-04':134C,160C,191C '-2026':23A,26A '-86060':24A,27A '26':133C,159C,190C 'accord':123C 'action':119C 'activ':80B 'adher':187C 'allow':103C 'analysi':88B 'appli':120C 'applic':157C 'argument':7A,58B,96C 'argument-handl':6A 'asset':181C 'attack':65B,105C 'base':138C 'begin':18A 'bod':132C,158C,189C 'cert':83B 'chang':66B,107C 'cisa':76B,117C,130C,147C 'cloud':163C 'command':62B,100C 'complianc':128C 'contain':4A,91C 'cve':22A,25A 'delimit':59B,97C 'discontinu':166C 'ensur':127C,186C 'escal':47B,116C 'evalu':179C 'exploit':39B,81B 'exposur':184C 'flaw':9A 'follow':156C 'forens':149C 'gain':73B 'gear':44B 'guidanc':145C,161C 'guidelin':193C 'handl':8A 'higher':74B 'host':51B 'improp':93C 'infrastructur':40B 'instruct':126C 'internet':183C 'involv':15A 'lead':113C 'let':63B 'list':77B 'login':13A 'mask':71B,112C 'mikrotik':1A,29A,31A,33A,35A,37A,41B,53B,89C 'mikrotrick':28A 'mitig':121C,172C 'network':43B 'network-gear':42B 'neutral':57B,94C 'note':144C,155C 'patch':192C 'path':14A 'polici':70B,111C 'polska':84B 'priorit':135C 'privileg':46B,75B,115C 'privilege-escal':45B 'product':170C 'prohibit':21A 'publish':85B 'requir':118C,151C 'respons':177C 'risk':140C 'routero':2A,3A,48B,54B,69B,90C,110C 'routeros':30A,32A,34A,36A,38A 'secur':136C 'see':141C,152C 'self':50B 'self-host':49B 'servic':164C 'ssh':12A,52B 'stakehold':175C 'technic':87B 'triag':150C 'trust':68B,109C 'unavail':174C 'updat':137C 'url':142C,153C 'use':167C 'usernam':16A 'vendor':125C 'vulner':101C","nicknames":["MikroTrick"],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-05T20:17:18+00:00","kev":{"dateAdded":"2026-09-10","dueDate":"2026-09-13","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-86060","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060","severity":null,"published_at":"2026-09-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-86060:120","url":null,"severity":null,"published_at":"2026-10-23T21:38:16+00:00","modified_at":"2026-10-23T21:38:16+00:00","first_seen_at":"2026-10-23T21:38:16+00:00","fetched_at":"2026-10-23T21:38:16+00:00","note":"Vendor page (MikroTik Sep 3 2026, updated Oct 6) + CERT.pl analysis + CVE record read. Part of the MikroTrick chain with CVE-2026-67279 (unauth SSH). Exploited since ~Sep 2; no public PoC link found (CERT.pl gave vendor a PoC privately). CVSS 4.0 9.2 per CVE record; severity raised to critical on that and exploitation."},{"source":"nvd","external_id":"CVE-2026-86060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86060","severity":null,"published_at":"2026-09-05T20:17:18+00:00","modified_at":"2026-09-11T12:52:16+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":827,"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","title":"MikroTik: September 2026 vulnerability","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":828,"url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","title":"CERT Polska: MikroTrick technical analysis","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1150,"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/","title":"BleepingComputer: Hackers exploit new MikroTik RouterOS flaws","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1151,"url":"https://www.cve.org/CVERecord?id=CVE-2026-86060","title":"CVE Record CVE-2026-86060","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1166,"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","title":"CERT.pl: MikroTrick, RouterOS vulnerabilities actively exploited","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}