CVE-2026-86060

Critical

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

9.8 CVSS v3.1 CVSS v4.0: 9.2

Published: Sep 5, 2026
Updated: Sep 11, 2026
Vendor: Mikrotik
Affected versions: See affected products
Weakness: CWE-88

Summary

RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Severity

Critical (9.8)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0 (9.2)

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Mikrotik Routeros >= 6.0, < 6.49.21
Mikrotik Routeros >= 7.0, < 7.23.4
Mikrotik Routeros >= 7.24, < 7.24.2

Exploitation status

Actively exploited

Listed in the CISA Known Exploited Vulnerabilities catalog on Sep 10, 2026. Federal remediation due: Sep 13, 2026.

Technical details

Technical analysis has not been written for this record yet.

Mitigation & remediation

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.