CVE-2026-86060
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
Description
CVE-2026-86060 is a critical argument injection vulnerability in MikroTik RouterOS that lets an unauthenticated attacker escalate privileges on the router. The flaw lives in the SSH login path: usernames beginning with a prohibited character are mishandled when arguments are passed to the RouterOS login helper, which allows the trusted RouterOS policy mask to be changed. Exploitation requires only an unauthenticated SSH session that reaches the login helper, so any RouterOS device with SSH exposed is at risk. MikroTik fixed this RouterOS vulnerability in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable); with a CVSS score of 9.8 and a CISA KEV listing, CVE-2026-86060 requires immediate patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| mikrotik | routeros | >= 6.0, < 6.49.21; >= 7.0, < 7.23.4; >= 7.24, < 7.24.2 |
References
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve(Third Party Advisory)
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/(Mitigation, Third Party Advisory)
- https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802(Release Notes)
- https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801(Release Notes)
- https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800(Release Notes)
- https://mikrotik.com/supportsec/september-2026-vulnerability/(Vendor Advisory)
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060(US Government Resource)
Weakness Type
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Argument injection occurs when software builds a command from upstream input but fails to neutralise characters that change how the target program parses its arguments, turning data into additional flags or options. In CVE-2026-86060 a username starting with a prohibited character is passed into the RouterOS login helper's argument list without neutralisation, so the attacker-controlled string is interpreted as an argument that alters the trusted policy mask instead of being treated as a plain username.
Learn more: CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Impact Analysis
CVE-2026-86060 is remotely exploitable over the network with low attack complexity, no authentication and no user interaction — reaching the SSH service of an affected RouterOS device is the only prerequisite. The result is high impact to confidentiality, integrity and availability: by changing the trusted policy mask the attacker gains elevated RouterOS privileges, which on a router means reading traffic and configuration, rewriting routing and firewall rules, and taking the device offline. Because RouterOS devices sit at network perimeters, a compromised router is also a durable pivot into the networks behind it and a platform for traffic interception. The CVSS 3.1 base score of 9.8 (Critical) reflects that severity; the EPSS score of roughly 1.0% (61st percentile) is the weaker signal here, since CERT Polska has reported active exploitation of RouterOS vulnerabilities and CISA has placed CVE-2026-86060 in the KEV catalog with a 13 September 2026 deadline.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-86060 by adding it to the Known Exploited Vulnerabilities catalog with a short 13 September 2026 remediation deadline. CERT Polska has published advisories on MikroTik RouterOS vulnerabilities including a post explicitly titled "Vulnerabilities in MikroTik RouterOS actively exploited", and a third-party technical write-up tagged as exploit material, "Reversing MikroTik's silent patch", reconstructs the fix in RouterOS 7.23.4 — meaning the vulnerable code path is publicly analysed and the barrier to building a working exploit is low. The EPSS score of about 1.0% (61st percentile) understates this substantially. The KEV ransomware flag is "Unknown", but internet-exposed RouterOS devices are routinely swept by botnet operators, so unpatched devices should be assumed to be targeted.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with MikroTik's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the device if mitigations are unavailable. The KEV due date is 13 September 2026.
- Upgrade RouterOS to a fixed release. MikroTik fixed the flaw in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable); affected ranges are 6.0 up to 6.49.21, 7.0 up to 7.23.4 and 7.24 up to 7.24.2, so choose the fixed build matching your release channel.
- Restrict or disable the SSH service until patched. Because exploitation requires an unauthenticated SSH session reaching the login helper, disable SSH on WAN interfaces, bind it to a management VLAN, or apply RouterOS firewall address-list rules so only trusted administrative addresses can connect.
- Audit the device for signs of compromise and reset trust. Review RouterOS user accounts, group policies, scheduler entries, scripts, SOCKS and proxy settings and firewall rules for unauthorised changes, export and compare the configuration against a known-good baseline, and change all router credentials and keys — a successful policy-mask change means the device must be treated as fully compromised.
- Harden argument handling and management access long term by keeping RouterOS on a supported long-term branch with prompt patching, exposing management services only through a VPN, and — as a general defence against argument injection — never allowing untrusted strings to flow into command argument positions without allowlist validation and explicit separation of options from operands.
Technical Details
CVE-2026-86060 is an argument injection flaw (CWE-88) in the RouterOS SSH login path: the login helper is invoked with the supplied username as an argument, and a username beginning with a prohibited character is not neutralised before it reaches that argument list. Because the helper's parser treats a leading special character as the start of an option rather than as data, the attacker-supplied username is consumed as a directive that modifies the trusted RouterOS policy mask — the internal representation of which permissions the session holds — resulting in privilege escalation rather than a failed login. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H records a network-reachable, low-complexity attack requiring no privileges and no user interaction, with full impact on confidentiality, integrity and availability at unchanged scope. The prerequisite stated by MikroTik is an unauthenticated SSH session reaching the login helper, which is precisely why blocking or restricting SSH is an effective interim mitigation while patches roll out.
Frequently Asked Questions
Is CVE-2026-86060 being actively exploited?
Yes. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog with a remediation due date of 13 September 2026, and CERT Polska has published an advisory reporting that MikroTik RouterOS vulnerabilities are being actively exploited. A public technical analysis reversing MikroTik's patch is also available, which lowers the effort needed to weaponise the flaw.
What products are affected by CVE-2026-86060?
MikroTik RouterOS is affected in versions 6.0 up to 6.49.21, 7.0 up to 7.23.4 and 7.24 up to 7.24.2. MikroTik fixed the issue in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable), so any device running an older build with SSH reachable is exposed.
How do I fix CVE-2026-86060?
Upgrade RouterOS to 6.49.21, 7.23.4 or 7.24.2 depending on your release channel. Until the upgrade is applied, disable SSH on internet-facing interfaces or restrict it to trusted management addresses, then audit users, policies, scripts and firewall rules for unauthorised changes and rotate all router credentials.
How severe is CVE-2026-86060?
CVE-2026-86060 is Critical with a CVSS 3.1 base score of 9.8. It is unauthenticated, network-exploitable, needs no user interaction, and fully compromises confidentiality, integrity and availability of the router through privilege escalation; the EPSS score sits near the 61st percentile, but confirmed active exploitation and public technical analysis make it an emergency fix for exposed devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.