CVE-2026-86060
Description
Critical CVSS 9.8 privilege escalation in MikroTik RouterOS (CVE-2026-86060) allows unauthenticated attackers to gain full control via SSH login flaws.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| routeros | 6.0 | 6.49.21 | vulnerable |
| routeros | 7.0 | 7.23.4 | vulnerable |
| routeros | 7.24 | 7.24.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately install the latest security updates provided by MikroTik for the RouterOS platform. The vendor has released specific patches across Long-term and Stable release branches to address the SSH argument-handling flaw.
Update affected systems
Ensure all MikroTik devices are updated to at least version 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Systems running versions prior to these releases remain vulnerable to unauthenticated privilege escalation.
Restrict access
Minimize the attack surface by disabling SSH on public-facing interfaces. Implement strict firewall rules or Access Control Lists (ACLs) to ensure that SSH management access is only reachable from trusted, internal IP addresses.
Monitor for exploitation
Review system logs for unusual SSH login attempts, specifically those involving usernames starting with prohibited or non-standard characters. Monitor for unauthorized changes to the RouterOS policy mask or unexpected administrative activity.
Detection Guidance
"To detect potential exploitation of CVE-2026-86060, monitor SSH logs for unauthenticated connection attempts and inspect login metadata for malformed usernames containing unexpected characters. Use network security monitoring tools to flag high-frequency SSH attempts targeting the RouterOS login helper. Additionally, implement integrity checks on the RouterOS policy mask and audit user permission levels for any unauthorized escalations that deviate from established security baselines."