CVE-2026-86060: MikroTik RouterOS Command Argument Flaw Added to CISA KEV
CISA added CVE-2026-86060, a critical MikroTik RouterOS argument-delimiter flaw enabling privilege escalation, to the KEV catalog on 2026-09-10. Federal patch deadline: 2026-09-13.
CVE-2026-86060: MikroTik RouterOS Command Argument Flaw Added to CISA KEV
TL;DR
CISA added CVE-2026-86060, a critical improper neutralization of argument delimiters (CWE-88) flaw in MikroTik RouterOS, to the Known Exploited Vulnerabilities catalog on 2026-09-10. The bug lets an attacker alter the trusted RouterOS policy mask and escalate privileges via the SSH login path. Federal agencies must remediate by 2026-09-13; every organization running RouterOS should inventory internet-facing management interfaces today and upgrade to 6.49.21, 7.23.4, or 7.24.2.
What this is
CVE-2026-86060 is an improper neutralization of argument delimiters in a command (CWE-88) in MikroTik RouterOS. The vulnerability name assigned by the vendor is "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability." The impact is that an attacker can change the trusted RouterOS policy mask, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper, and involves usernames that begin with a prohibited character. CISA added the CVE to the KEV catalog on 2026-09-10, with a federal remediation due date of 2026-09-13. Known ransomware use is listed as Unknown. Fixed versions are 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).
Why it matters
KEV membership means confirmed in-the-wild exploitation, not a theoretical rating. NVD rates the flaw 9.8 CRITICAL (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CERT.PL rates it 9.2 CRITICAL (CVSS 4.0); both signal network-reachable, no-privilege, high-impact. EPSS sits at 0.01057 (62.8th percentile), which is modest on its own, but KEV membership overrides EPSS for prioritization. The federal due date of 2026-09-13 is three days after the KEV addition, so the window for inventory, exposure assessment, and patching is extremely short. Any RouterOS device exposing SSH to untrusted networks should be considered at elevated risk.
How it works
The flaw is an argument-delimiter neutralization failure in a command path. An attacker can change the trusted RouterOS policy mask, which is the mechanism behind the privilege escalation. Reaching the vulnerable code requires an unauthenticated SSH session to the RouterOS login helper, and the attack involves usernames that begin with a prohibited character. The original advisory does not state further version-specific mechanics beyond the fixed releases: 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).
Detection and response
Hypothesis: a RouterOS device exposing SSH to an untrusted network has been accessed through the login helper with a crafted username, and its policy mask has been altered. Evidence that confirms or rejects this comes from the running firmware version, external SSH reachability, authentication logs showing anomalous usernames or policy-mask changes, and a match against the MikroTik September 2026 security advisory and the NVD entry for CVE-2026-86060.
What to do
- Inventory. Enumerate every MikroTik RouterOS asset — routers, switches, wireless gear, CHR/cloud-hosted instances — and record firmware version, management exposure, and business owner.
- Assess exposure. Flag any device with SSH reachable from the internet or untrusted networks. CISA's BOD 26-04 guidance directs stakeholders to evaluate each asset's internet exposure and apply patching guidelines accordingly.
- Patch. Upgrade to a fixed release: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Follow MikroTik's September 2026 security advisory for the vendor-recommended path.
- Mitigate where patching is delayed. Restrict SSH management to trusted networks, disable unused services, and enforce least-privilege accounts. If mitigations are unavailable, follow BOD 26-04 guidance for cloud services or discontinue use of the product.
- Verify. Confirm the running firmware version post-upgrade, re-test SSH reachability from external vantage points, and review authentication logs for anomalous usernames or policy-mask changes.
- Triage forensics. Apply CISA's Forensics Triage Requirements for BOD 26-04 to determine whether the device was accessed or modified before patching.
- Close the ticket. Document version, exposure state, verification evidence, and any forensic findings; retain records for audit.
FAQ
Is CVE-2026-86060 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-10, indicating confirmed exploitation in the wild.
What is the CISA due date? Federal civilian executive branch agencies must remediate by 2026-09-13. Non-federal organizations should treat that date as a strong prioritization signal.
Is this exploitable over the internet? The flaw is reachable through an unauthenticated SSH session to the RouterOS login helper. Any RouterOS device exposing SSH to untrusted networks should be considered at elevated risk — evaluate each asset's internet exposure per BOD 26-04.
Is there a ransomware tie? CISA lists known ransomware use as Unknown for this CVE. Absence of a confirmed link does not reduce urgency given KEV status and the critical CVSS ratings.
Which versions fix it? MikroTik fixed the issue in 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).
Are public exploits available? Public proof-of-concept references exist, including a GitHub repository. Assume exploitability and prioritize patching over further research.
What is the CVSS and EPSS score? NVD rates it 9.8 CRITICAL (CVSS 3.1) and CERT.PL rates it 9.2 CRITICAL (CVSS 4.0). EPSS is 0.01057 (62.8th percentile), but KEV membership overrides EPSS for prioritization.