Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-86060

Published 2026-09-05

Updated last month

Vendor/s

MikroTik

Product/s

RouterOS

Version/s

6.0 > 6.49.21

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

Critical CVSS 9.8 privilege escalation in MikroTik RouterOS (CVE-2026-86060) allows unauthenticated attackers to gain full control via SSH login flaws.

## Why this matters

"CVE-2026-86060 is a critical vulnerability with a CVSS score of 9.8, representing a severe risk to network infrastructure. It allows unauthenticated attackers to gain elevated privileges on MikroTik RouterOS devices by exploiting a flaw in how the SSH login path handles specific username characters. Because this vulnerability is listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, it is confirmed to be under active exploitation. Security teams should prioritize this update immediately, as successful exploitation grants full administrative control, potentially allowing attackers to intercept traffic, pivot through the network, or disrupt critical communications."

## CPE

MikroTik

| Product  | Version Start | Version End (excl.) | Status     |
| -------- | ------------- | ------------------- | ---------- |
| routeros | 6.0           | 6.49.21             | vulnerable |
| routeros | 7.0           | 7.23.4              | vulnerable |
| routeros | 7.24          | 7.24.2              | vulnerable |

## Related weakness (CWE)

CWE-88

## Remediation plan

1

### Apply official patches

Immediately install the latest security updates provided by MikroTik for the RouterOS platform. The vendor has released specific patches across Long-term and Stable release branches to address the SSH argument-handling flaw.

2

### Update affected systems

Ensure all MikroTik devices are updated to at least version 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Systems running versions prior to these releases remain vulnerable to unauthenticated privilege escalation.

3

### Restrict access

Minimize the attack surface by disabling SSH on public-facing interfaces. Implement strict firewall rules or Access Control Lists (ACLs) to ensure that SSH management access is only reachable from trusted, internal IP addresses.

4

### Monitor for exploitation

Review system logs for unusual SSH login attempts, specifically those involving usernames starting with prohibited or non-standard characters. Monitor for unauthorized changes to the RouterOS policy mask or unexpected administrative activity.

## Detection Guidance

"To detect potential exploitation of CVE-2026-86060, monitor SSH logs for unauthenticated connection attempts and inspect login metadata for malformed usernames containing unexpected characters. Use network security monitoring tools to flag high-frequency SSH attempts targeting the RouterOS login helper. Additionally, implement integrity checks on the RouterOS policy mask and audit user permission levels for any unauthorized escalations that deviate from established security baselines."

## References

[https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory ](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve)[https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Mitigation Third Party Advisory ](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)[https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 Release Notes ](https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802)[https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes ](https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801)[https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes ](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800)[https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory ](https://mikrotik.com/supportsec/september-2026-vulnerability/)[https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ Exploit Third Party Advisory ](https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-86060 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)