Critical severity9.8CISA KEVNVD Advisory· Published Sep 5, 2026· Updated Sep 11, 2026
CVE-2026-86060
CVE-2026-86060
Description
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Affected products
2Patches
Vulnerability mechanics
References
8- npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/nvdExploitThird Party Advisory
- cert.pl/en/posts/2026/09/mikrotik-routeros-cvenvdThird Party Advisory
- cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/nvdMitigationThird Party Advisory
- mikrotik.com/supportsec/september-2026-vulnerability/nvdVendor Advisory
- forum.mikrotik.com/t/6-49-21-long-term-is-released/272802nvdRelease Notes
- forum.mikrotik.com/t/7-23-4-long-term-is-released/272801nvdRelease Notes
- forum.mikrotik.com/t/7-24-2-stable-is-released/272800nvdRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
12- SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the WildThe Hacker News · Sep 26, 2026
- MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH KeyThe Hacker News · Sep 23, 2026
- MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without LoginCyber Security News · Sep 18, 2026
- 14th September – Threat Intelligence ReportCheck Point Research · Sep 14, 2026
- CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVThe Hacker News · Sep 12, 2026
- Mikrotik: 2 Actively-Exploited Flaws Added to CISA KEVVypr Intelligence · Sep 10, 2026
- MikroTik Issues Patches for Routers Amid Zero-Day AttacksGovInfoSecurity · Sep 8, 2026
- MikroTik Patches Critical Flaws Chained to Hack RoutersSecurityWeek · Sep 8, 2026
- MikroTik router flaws allow takeover without a passwordMalwarebytes Labs · Sep 8, 2026
- ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and MoreThe Hacker News · Sep 7, 2026
- Hackers exploit RouterOS flaws to hijack MikroTik devices without authenticationHelp Net Security · Sep 7, 2026
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts