CRITICAL
CVE-2026-86060
CVSS
9.8
KEV
Description
RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Weakness (CWE)
CWE-88
EPSS Score
1.06%
Probability of exploitation in next 30 days
62.9th percentile
References
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
Third Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
Mitigation, Third Party Advisory
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
Release Notes
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/
Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060
US Government Resource
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.