CVE-2026-86060: mikrotik routeros

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-09-10 · published 2026-09-05

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Affected products (NVD): mikrotik routeros

Fixed in (NVD): 6.49.21, 7.23.4, 7.24.2

Weakness: CWE-88

Source: NVD CVE-2026-86060

References

• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
• https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
• https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
• https://mikrotik.com/supportsec/september-2026-vulnerability/
• https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.