CVE-2026-86060: MikroTik RouterOS Command Argument Flaw Added to CISA KEV
CISA added CVE-2026-86060, a critical MikroTik RouterOS argument-delimiter flaw enabling privilege escalation, to the KEV catalog on 2026-09-10. Federal patch deadline: 2026-09-13.
CVE-2026-86060: MikroTik RouterOS Command Argument Flaw Added to CISA KEV
TL;DR
CISA added CVE-2026-86060, a critical improper neutralization of argument delimiters (CWE-88) flaw in MikroTik RouterOS, to the Known Exploited Vulnerabilities catalog on 2026-09-10. The bug lets an attacker alter the trusted RouterOS policy mask and escalate privileges via the SSH login path. Federal agencies must remediate by 2026-09-13; every organization running RouterOS should inventory internet-facing management interfaces today and upgrade to 6.49.21, 7.23.4, or 7.24.2.
What is this vulnerability?
- CVE ID: CVE-2026-86060
- Vendor / product: MikroTik / RouterOS
- Vulnerability name: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- Weakness: CWE-88 (Improper Neutralization of Argument Delimiters in a Command)
- Impact: An attacker can change the trusted RouterOS policy mask, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper, and involves usernames that begin with a prohibited character.
- CISA KEV status: Yes — added 2026-09-10
- CISA due date: 2026-09-13
- Fixed versions: 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable)
- Known ransomware use: Unknown
KEV vs CVSS vs EPSS
| Signal | What it measures | How to use it for this CVE |
|---|---|---|
| CISA KEV | Confirmed in-the-wild exploitation | Treat as exploited. This CVE is in KEV with a 2026-09-13 federal due date — prioritize above non-KEV criticals. |
| CVSS | Theoretical severity of the flaw | NVD rates it 9.8 CRITICAL (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CERT.PL rates it 9.2 CRITICAL (CVSS 4.0). Both signal network-reachable, no-privilege, high-impact. |
| EPSS | Probability of exploitation in the next 30 days | 0.01057 (62.8th percentile). Modest on its own — but KEV membership overrides EPSS for prioritization. |
Step-by-step remediation
- Inventory. Enumerate every MikroTik RouterOS asset — routers, switches, wireless gear, CHR/cloud-hosted instances — and record firmware version, management exposure, and business owner.
- Assess exposure. Flag any device with SSH reachable from the internet or untrusted networks. CISA's BOD 26-04 guidance directs stakeholders to evaluate each asset's internet exposure and apply patching guidelines accordingly.
- Patch. Upgrade to a fixed release: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Follow MikroTik's September 2026 security advisory for the vendor-recommended path.
- Mitigate where patching is delayed. Restrict SSH management to trusted networks, disable unused services, and enforce least-privilege accounts. If mitigations are unavailable, follow BOD 26-04 guidance for cloud services or discontinue use of the product.
- Verify. Confirm the running firmware version post-upgrade, re-test SSH reachability from external vantage points, and review authentication logs for anomalous usernames or policy-mask changes.
- Triage forensics. Apply CISA's Forensics Triage Requirements for BOD 26-04 to determine whether the device was accessed or modified before patching.
- Close the ticket. Document version, exposure state, verification evidence, and any forensic findings; retain records for audit.
FAQ
Is CVE-2026-86060 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-10, indicating confirmed exploitation in the wild.
What is the CISA due date? Federal civilian executive branch agencies must remediate by 2026-09-13. Non-federal organizations should treat that date as a strong prioritization signal.
Is this exploitable over the internet? The flaw is reachable through an unauthenticated SSH session to the RouterOS login helper. Any RouterOS device exposing SSH to untrusted networks should be considered at elevated risk — evaluate each asset's internet exposure per BOD 26-04.
Is there a ransomware tie? CISA lists known ransomware use as Unknown for this CVE. Absence of a confirmed link does not reduce urgency given KEV status and the critical CVSS ratings.
Which versions fix it? MikroTik fixed the issue in 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).
Are public exploits available? Public proof-of-concept references exist, including a GitHub repository. Assume exploitability and prioritize patching over further research.